CVE-2016-20046CWE-787

zFTP Client 20061220+dfsg3-4.1 Local Buffer Overflow

High · published March 28, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
3.8
In the wild
Unconfirmed
What it is

zFTP Client 20061220+dfsg3-4.1 contains a buffer overflow vulnerability in the NAME parameter handling of FTP connections that allows local attackers to crash the application or execute arbitrary code. Attackers can supply an oversized NAME value exceeding the 80-byte buffer allocated in strcpy_chk to overwrite the instruction pointer and execute shellcode with user privileges.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00150 · 3.8th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-03-28T11:58Z
EPSS history
Timeline
  • 28 MAR 11:58Z
    zFTP Client 20061220+dfsg3-4.1 Local Buffer Overflow
    cvelistv5