Home

Description

NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending crafted FTP commands. Attackers can connect to the FTP service and send oversized data in response handlers to overwrite SEH pointers and redirect execution to injected shellcode.

PUBLISHED Reserved 2026-04-04 | Published 2026-04-04 | Updated 2026-04-06 | Assigner VulnCheck




CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Out-of-bounds Write

Product status

3.0.1.19
affected

Credits

Abdullah Alıç finder

References

www.exploit-db.com/exploits/45442 (ExploitDB-45442) exploit

en.softonic.com/download/nico-ftp/windows/post-download (Product Reference) product

www.vulncheck.com/advisories/nico-ftp-buffer-overflow-seh (VulnCheck Advisory: NICO-FTP 3.0.1.19 Buffer Overflow SEH) third-party-advisory

cve.org (CVE-2018-25254)

nvd.nist.gov (CVE-2018-25254)

Download JSON