CVE-2002-2226: TFTP32 tftpd Buffer Overflow via Long Filename

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw is remotely exploitable without authentication, has public exploit code, and carries a high EPSS score, though it is not listed in CISA KEV.

What it is

TFTP32 2.21 and earlier contains a buffer overflow in its tftpd component that is triggered by a long filename argument. A remote attacker can send a crafted TFTP request to overflow the buffer and potentially execute arbitrary code on the host. The flaw is remotely reachable and requires no authentication.

Impact

An attacker can execute arbitrary code with the privileges of the tftpd service, leading to full compromise of the affected system. Because TFTP is unauthenticated, the attacker gains code execution without any prior credentials.

Attack surface

The vulnerability is reached over the network via the TFTP service, typically on UDP port 69. No authentication or user interaction is required; the attacker only needs to send a crafted request containing an overly long filename.

Exploitation

Exploit code is publicly referenced in the SecurityFocus and SecuriTeam entries, indicating that working exploits are available. The CVE is not listed in CISA KEV, but EPSS estimates a 63.5% probability of exploitation in the next 30 days (99th percentile).

What to do

• Upgrade TFTP32 to a version later than 2.21 if available, or replace it with a maintained TFTP server.
• Restrict network access to the TFTP service to trusted hosts only, using firewall rules or network segmentation.
• Disable the TFTP service entirely if it is not required for business operations.
• Run the TFTP service with minimal privileges and in a sandboxed environment to limit the impact of a successful exploit.
• Monitor vendor and CERT/CC advisories for updated guidance and patches.

Detection

• Inspect TFTP request logs for unusually long filename fields or malformed packets.
• Use network intrusion detection signatures that flag buffer overflow attempts against TFTP services.
• Monitor for unexpected process creation or crashes originating from the tftpd process.
• Correlate TFTP traffic with subsequent suspicious outbound connections or file writes on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.