Vulnerability record · CVE-2023-53886 · published 15 December 2025

CVE-2023-53886: Xlightftpd xlight ftp server stack-based buffer overflow vulnerability

Xlightftpd · Xlight Ftp Server

Xlight FTP Server 3.9.3.6 contains a stack buffer overflow vulnerability in the 'Execute Program' configuration that allows attackers to crash the application. Attackers can trigger the vulnerability by inserting 294 characters into the program execution configuration, causing a denial of service condition.

5.1 CVSS 4.0 Medium EPSS 0.43% · top 65.4% CWE-121 · Stack-based buffer overflowCWE-787 · Out-of-bounds write

5.1CVSS 4.0 base score

0.43%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Xlight Ftp Server Xlightftpd

References

Link	Tags
https://www.exploit-db.com/exploits/51665	ExploitThird Party Advisory
https://www.vulncheck.com/advisories/xlight-ftp-server-stack-buffer-overflow-vulnerability-via-execute-program	Third Party Advisory
https://www.xlightftpd.com/	Vendor Advisory
https://www.exploit-db.com/exploits/51665	ExploitThird Party Advisory

Track CVE-2023-53886 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2019-25681Xlightftpd xlight ftp server out-of-bounds write vulnerabilityXlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attackers to crash the application an…EPSS 0.21%5 Apr 2026 7.5CVE-2024-0737Xlightftpd xlight ftp server improper resource shutdown vulnerabilityA vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. This vulnerability affects unknown code of the component Log…EPSS 4.2%19 Jan 2024 6.8CVE-2009-4795Xlightftpd xlight ftp server sql injection vulnerabilityMultiple SQL injection vulnerabilities in Xlight FTP Server before 3.2.1, when ODBC authentication is enabled, allow remote attackers to execute arbi…EPSS 2.0%22 Apr 2010 6.5CVE-2010-2695Xlightftpd xlight ftp server path traversal vulnerabilityDirectory traversal vulnerability in the SFTP/SSH2 virtual server in Xlight FTP Server 3.5.0, 3.5.5, and possibly other versions before 3.6 allows re…EPSS 1.9%12 Jul 2010 8.8CVE-2026-7273Zyxel gs1900-8 firmware stack-based buffer overflow vulnerabilityA stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-base…KEVEPSS 2.5%16 Jun 2026 8.1CVE-2021-27137DD-WRT UPnP M-SEARCH stack buffer overflowDD-WRT before 45724 contains an unsafe strcpy in the UPnP SSDP handling code (ssdp_msearch), reachable via an M-SEARCH request, that overflows a fixe…KEVEPSS 4.0%analysed16 Jul 2026 9.3CVE-2025-53521F5 BIG-IP APM stack buffer overflow allows remote code executionA stack-based buffer overflow (CWE-121) exists in F5 BIG-IP Access Policy Manager when an APM access policy is configured on a virtual server. Specif…KEVEPSS 2.3%analysed15 Oct 2025 8.8CVE-2008-0015Microsoft DirectShow Video ActiveX Control Stack Buffer OverflowA stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL) is reachable through the MPEG2TuneRequ…KEVEPSS 77%analysed7 Jul 2009

Source: NIST National Vulnerability Database (record CVE-2023-53886), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.