Cyber Resilience

CVE-2003-0466

Redhat Wu Ftpd 2.6.1-16

Public PoCHigh EPSS
Published
27 August 2003
Modified
16 April 2026
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.78 99.5th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2003-0466 is a critical-severity Off-by-one Error (CWE-193) vulnerability in Redhat Wu Ftpd. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer…

more

overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.

CWE(s)
CWE-193

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Buffer overflow in wu-ftpd's fb_realpath() enables remote code execution via crafted FTP commands against a public-facing FTP service.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-58380Same vendor: Redhat
CVE-2026-58014Same vendor: Redhat
CVE-2025-47711Same vendor: Redhat
CVE-2026-4887Same vendor: Redhat
CVE-2025-11215Same vendor: Apple
CVE-2026-56787Shared CWE-193
CVE-2023-44444Shared CWE-193
CVE-2026-58374Shared CWE-193
CVE-2024-31585Shared CWE-193
CVE-2024-47682Shared CWE-193

Affected Assets

redhat
wu ftpd
2.6.1-16
wuftpd
wu-ftpd
2.5.0 — 2.6.2
apple
mac os x
10.2.6
apple
mac os x server
10.2.6
freebsd
freebsd
4.0 — 5.0
netbsd
netbsd
1.5 — 1.6.1
openbsd
openbsd
2.0 — 3.3
sun
solaris
9.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V6.2.1

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent off-by-one errors via reviews, static analysis, and testing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development and acceptance can detect off-by-one errors before release.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle includes requirements and reviews that can catch off-by-one errors.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify bounds-checking and input validation to prevent off-by-one errors.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture and engineering principles promote defensive coding practices that reduce off-by-one mistakes.

A.8.28 Secure coding partial match
prevents

Secure coding directly addresses off-by-one errors through coding standards and peer review.

References