CVE-2026-67191

CVE-2026-67191 describes a pre-authentication heap buffer overflow vulnerability found in Xlight FTP Server versions prior to 3.9.5. This flaw allows remote, unauthenticated attackers to write beyond the allocated memory of a heap buffer. The vulnerability is triggered by sending a malformed SSH client identification string. The root cause of this issue lies in a logic error within the `recv` loop's termination condition, where an incorrect OR operator is used instead of an AND operator. This oversight enables the exploitation of the vulnerability on any SSH or SFTP connection before authentication takes place.