Junglewise Threat Intelligence

CVE-2025-14242: vsftpd denial of service via integer overflow in ls parameter parsing

CVE-2025-14242 · Severity: medium · CVSS 6.5 · Published 2026-01-14

Technologies: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Executive brief

A vulnerability has been identified in vsftpd, a widely used service for transferring files over a network. An authenticated user can exploit this flaw to crash the service, leading to a denial of service. This could disrupt business operations that rely on automated or manual file transfers, though it does not directly expose sensitive data.

Technical details

An integer overflow vulnerability exists in vsftpd within the logic used to parse parameters for the 'ls' command. The issue is triggered when a remote, authenticated attacker sends a specifically crafted 'STAT' command containing a unique byte sequence. This overflow leads to a service crash, resulting in a denial of service (DoS) condition. The vulnerability is tracked as CVE-2025-14242 and has been addressed in various Red Hat Enterprise Linux package updates (e.g., vsftpd-3.0.5-10.el10_1.1). Authentication is a prerequisite for exploitation.

Affected products

  • vsftpd project vsftpd 3.0.3, 3.0.5
  • Red Hat Enterprise Linux 8 vsftpd < 3.0.3-36.el8_10.3
  • Red Hat Enterprise Linux 9 vsftpd < 3.0.5-6.el9_7.2
  • Red Hat Enterprise Linux 10 vsftpd < 3.0.5-10.el10_1.1

Timeline

  • 2025-01-14: disclosed: CVE-2025-14242 assigned
  • 2026-01-14: advisory: Red Hat published security advisories (RHSA-2026:0605, RHSA-2026:0606)
  • 2026-01-14: patched

References

Related threats