# CVE-2026-67192: Xlight FTP Server stack buffer overflow in SSH GCM cipher

Source: https://junglewise.ai/threats/cve-2026-67192-xlight-ftp-server-stack-buffer-overflow-in-ssh-gcm-cipher  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-67192 · Severity: high · CVSS 8.1 · Published 2026-07-29

Xlight FTP Server, a high-performance file transfer solution, is vulnerable to a critical security flaw in its SSH/SFTP component. An unauthenticated attacker can exploit this to take full control of the server or disrupt its operations before a user even logs in. This could lead to the theft of sensitive files, data corruption, or a complete shutdown of the file transfer service.

## Quick answers

**Is CVE-2026-67192 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67192 being exploited in the wild.

**How severe is CVE-2026-67192?** High severity, with a CVSS score of 8.1, published 29 July 2026.

**Which products and versions are affected?** Xlight Xlight FTP Server before 3.9.5.

**Is there a fix for CVE-2026-67192?** A patch was published on 2026-07-01: Version 3.9.5 released fixing security vulnerabilities Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67192 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-67192?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in Xlight FTP Server versions prior to 3.9.5. The vulnerability is triggered during the SSH handshake when a GCM cipher is negotiated. An attacker can send a malformed SSH packet containing an unvalidated length field that is passed directly to the GCM decryption function. This allows the attacker to overwrite the stack cookie and return address, potentially leading to remote code execution (RCE) in a pre-authentication context. The vendor has addressed this in version 3.9.5.

## Affected products

- Xlight Xlight FTP Server before 3.9.5

## Timeline

- 2026-07-01: patched: Version 3.9.5 released fixing security vulnerabilities
- 2026-07-29: disclosed: Public disclosure of CVE-2026-67192

## References

- [https://www.vulncheck.com/advisories/xlight-ftp-server-pre-auth-stack-buffer-overflow-via-ssh-gcm-cipher](https://www.vulncheck.com/advisories/xlight-ftp-server-pre-auth-stack-buffer-overflow-via-ssh-gcm-cipher)
- [https://www.xlightftpd.com/whatsnew.htm](https://www.xlightftpd.com/whatsnew.htm)