PT-2026-28229 · Undefined · Undefined

Published 2026-03-28 · Updated 2026-05-01 · CVE-2016-20046

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions zFTP Client version 20061220+dfsg3-4.1

Description A buffer overflow occurs during the handling of the NAME parameter in FTP connections. A local attacker can provide an oversized NAME value that exceeds the 80-byte buffer allocated in the strcpy chk() function, allowing them to overwrite the instruction pointer and execute shellcode with user privileges or cause the application to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2016-20046

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-20046 · Security Note
• https://vulncheck.com/advisories/zftp-client-20061220-dfsg3-local-buffer-overflow · Note
• https://exploit-db.com/exploits/40203 · Note
• https://t.me/cveNotify/161752 · Telegram Post
• http://cernlib.web.cern.ch/cernlib · Note