CVE-2025-3726: High Buffer Overflow in PCMan FTP Server

CVE-2025-3726 is a high severity buffer overflow flaw (CVSS 7.3) in PCMan FTP Server 2.0.7. It sits in the CD command handler and can be reached over the network without a login. The record lists no fixed version, so check the project page, and restrict access to the FTP port.

What's affected

The record names PCMan FTP Server version 2.0.7. The affected component is the CD command handler, where the record says manipulation leads to a buffer overflow. The record lists no fixed version. The description also says the attack may be launched remotely.

The record lists the weakness as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-120 (buffer copy without checking the size of input). The CVSS 3.1 score is 7.3 (high), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The vector shows the flaw can be reached over the network, and no login is needed. Confidentiality impact is rated low, integrity low and availability low.

The record says the exploit has been disclosed to the public and may be used. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false. Treat any copy that is reachable from the internet as the priority.

How to check if you're exposed

PCMan FTP Server is a Windows program, so there is usually no package manager entry to query. Check the host instead.

1. Find out whether PCMan FTP Server runs on a host. From a command prompt, list listeners on the FTP port:

netstat -ano | findstr LISTENING | findstr :21

2. Match the process id in the last column to a running program in Task Manager, then open the program's about box or file properties and compare the version with 2.0.7, the version named in the record.
3. Check who can reach the port. Review the host firewall and any router or cloud rules that forward port 21 to this machine.
4. Review the FTP server log and the Windows event log for repeated crashes or restarts, and for very long CD commands from addresses you do not recognize.

If you manage many repositories, the free in-browser dependency scan covers the libraries your projects pull in, and the Gold directory lets you look up other CVEs by product. Neither replaces reviewing the code of an application you deploy by hand.

What to do now

1. Do not expose the service to the internet. Restrict it to trusted networks or place it behind a VPN.
2. Check the vendor or project page for a newer release. The record gives no fixed version, so the advisory should be checked before you plan an upgrade.
3. If the service is no longer needed, stop it and remove it. Old, unmaintained servers are a common source of this kind of finding.
4. Run the service under an account with the fewest permissions possible so that a crash or compromise stays contained.
5. Log connections and watch for repeated service crashes or restarts, which can signal probing.
6. Consider a maintained alternative if the project shows no recent releases.

Why it matters

A buffer overflow happens when a program copies input into a fixed size block of memory without first checking that it fits. The extra data spills into neighboring memory. The usual result is a crash. In the worst case an attacker can change how the program runs.

Network services written in C or C++ are exposed to this class of bug because the language leaves bounds checking to the developer. The weakness classes the record lists describe exactly that. Fixing it means checking lengths before every copy, or using safer string and buffer handling.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Gold entry for CVE-2025-3726
• NVD record for CVE-2025-3726, published 2025-04-16, as summarized above
• Reference listed in the record
• Reference listed in the record
• Reference listed in the record
• Reference listed in the record

Last reviewed: 18 October 2026.