CVE-2019-25681
Published: 05 April 2026
Summary
CVE-2019-25681 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Xlightftpd Xlight Ftp Server. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
Xlight FTP Server version 3.9.1 is affected by CVE-2019-25681, a structured exception handler (SEH) overwrite vulnerability stemming from a buffer overflow. The issue arises when a crafted 428-byte payload is supplied through the program execution field in the virtual server configuration, corrupting the SEH chain and allowing attackers to overwrite SEH pointers. This CWE-787 vulnerability enables application crashes and potential code execution, with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Local attackers with no required privileges can exploit this vulnerability by injecting the malicious buffer string during virtual server configuration. Successful exploitation leads to SEH chain corruption, application denial of service through crashes, and the potential for arbitrary code execution with the privileges of the FTP server process.
Advisories from Vulncheck detail the SEH overwrite buffer overflow, while Exploit-DB hosts a public exploit at https://www.exploit-db.com/exploits/46458. The vendor's website at https://www.xlightftpd.com provides a download link for xlight.zip, potentially containing updates, along with the main product page at https://www.xlightftpd.com/index.htm.
A proof-of-concept exploit is publicly available, indicating potential for real-world exploitation against unpatched instances of this legacy FTP server software.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20097
Vulnerability details
Xlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution…
more
field in virtual server configuration to trigger a buffer overflow that corrupts the SEH chain and enables potential code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local SEH overwrite buffer overflow in server config enables arbitrary code execution (with server process privileges) or DoS via crash; directly maps to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the buffer overflow vulnerability by requiring timely application of vendor patches or upgrades to Xlight FTP Server.
Requires validation of inputs to the program execution field in virtual server configuration to prevent crafted payloads from causing buffer overflows.
Implements memory protections such as ASLR and DEP that disrupt SEH chain overwrites and hinder arbitrary code execution from stack-based overflows.