CVE-2019-25681

HighPublic PoC

Published: 05 April 2026

Published

05 April 2026

Modified

09 April 2026

KEV Added

—

Patch

—

CVSS Score 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 5.1th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25681 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Xlightftpd Xlight Ftp Server. Its CVSS base score is 8.4 (High).

Operationally, ranked at the 5.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the buffer overflow vulnerability by requiring timely application of vendor patches or upgrades to Xlight FTP Server.

SI-10 Information Input Validation good match

prevent

Requires validation of inputs to the program execution field in virtual server configuration to prevent crafted payloads from causing buffer overflows.

SI-16 Memory Protection good match

prevent

Implements memory protections such as ASLR and DEP that disrupt SEH chain overwrites and hinder arbitrary code execution from stack-based overflows.

NVD Description

Xlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution…

field in virtual server configuration to trigger a buffer overflow that corrupts the SEH chain and enables potential code execution.

Deeper analysisAI

Xlight FTP Server version 3.9.1 is affected by CVE-2019-25681, a structured exception handler (SEH) overwrite vulnerability stemming from a buffer overflow. The issue arises when a crafted 428-byte payload is supplied through the program execution field in the virtual server configuration, corrupting the SEH chain and allowing attackers to overwrite SEH pointers. This CWE-787 vulnerability enables application crashes and potential code execution, with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Local attackers with no required privileges can exploit this vulnerability by injecting the malicious buffer string during virtual server configuration. Successful exploitation leads to SEH chain corruption, application denial of service through crashes, and the potential for arbitrary code execution with the privileges of the FTP server process.

Advisories from Vulncheck detail the SEH overwrite buffer overflow, while Exploit-DB hosts a public exploit at https://www.exploit-db.com/exploits/46458. The vendor's website at https://www.xlightftpd.com provides a download link for xlight.zip, potentially containing updates, along with the main product page at https://www.xlightftpd.com/index.htm.

A proof-of-concept exploit is publicly available, indicating potential for real-world exploitation against unpatched instances of this legacy FTP server software.