ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-53994 represents a critical memory safety vulnerability in ProFTPD's mod_sftp module that allows authenticated SFTP users to trigger a heap-based buffer overflow through malformed packet handling. The vulnerability stems from insufficient validation of the 32-bit big-endian SFTP packet length in the fxp_packet_read() function. When an attacker supplies a zero value, it cascades through the read path causing an unsigned integer underflow that balloons to approximately 4 GB, ultimately resulting in a type confusion bug when size_t calculations are truncated to 32-bit integers during memory allocation. This affects organizations running ProFTPD with mod_sftp enabled, particularly those accepting SFTP connections from untrusted or compromised user accounts. With a CVSS score of 7.5 (High) and no patch availability yet, this represents an immediate risk for file transfer infrastructure.
While Casky.ai currently shows zero mapped skills for this specific CVE, practitioners using the platform with Claude's extended reasoning capabilities should focus detection efforts on CWE-122 (Heap-based Buffer Overflow) patterns and related memory corruption indicators. Although no specific MITRE ATT&CK techniques are formally mapped, defenders should monitor for anomalous SFTP protocol behavior including malformed packet structures, unusual memory allocation patterns, and process crashes in ProFTPD services—signals that would typically manifest under techniques like T1570 (Adversary-in-the-Middle) or T1021.004 (Remote Services: SSH/SCP). Security teams should implement network segmentation to restrict SFTP access, disable mod_sftp if unused, and establish baselines for normal SFTP packet sizes to detect exploitation attempts in real-time.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-53994. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation