CVE-2025-4180 is a high severity (CVSS 7.3) buffer overflow in PCMan FTP Server 2.0.7. The TRACE command handler mishandles input and the record says it can be attacked remotely. No fixed version is confirmed, so stop exposing the service or replace it.
What's affected
PCMan FTP Server, version 2.0.7, per the record. The affected component is the TRACE command handler. The record does not name the exact function, only that it is unknown.
The score is 7.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That reads as network reachable, low complexity, no privileges and no user interaction, with limited impact on confidentiality, integrity and availability. The record says the exploit has been disclosed to the public and may be used, and it references a public exploit write-up. It does not state that the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
The record lists no patched release, and the vulnerability database pages it points to could not be read when this post was reviewed. Do not assume a newer version is safe. Check the vendor or project source and the CVE record for updates before relying on one.
PCMan FTP Server has a run of similar buffer overflow CVEs in other command handlers in the same release, so fixing one will not settle the others. Treat the server as having a class of problem, not a single bug.
How to check if you're exposed
PCMan FTP Server is a Windows program and is often run as a standalone executable with no installer entry. Start by finding out whether it is running and what it is listening on. In PowerShell:
Get-NetTCPConnection -State Listen -LocalPort 21 | Select-Object LocalAddress,LocalPort,OwningProcess
Get-Process -Id (Get-NetTCPConnection -State Listen -LocalPort 21).OwningProcess
Look for a process named like PCManFTPD. The service may be on a port other than 21, so also search the file system for the executable:
Get-ChildItem -Path C:\ -Recurse -Filter "PCMan*" -ErrorAction SilentlyContinue
If it is present, read the version in the file properties or the program's about box. Version 2.0.7 is named in the record, and for some of the related CVEs earlier versions are in scope too.
Then check from outside the host: can the FTP port be reached from the internet or from networks that should not have it? A firewall rule is easier to verify than a patch level.
What to do now
- List every host that runs PCMan FTP Server, including old file transfer boxes and lab machines.
- If the service is not needed, stop it and remove it.
- If you need file transfer, move to a maintained server that uses SFTP or FTPS, and check its own advisory feed.
- Until then, restrict the port to the specific addresses that need it, and do not expose it to the internet.
- Run the service under an account with no administrative rights, and keep it off machines that hold sensitive data.
- Review logs and the machine itself for unexpected crashes, restarts or new files around the time the service was exposed.
Why it matters
The record classes this as CWE-119, improper restriction of operations within the bounds of a memory buffer, and CWE-120, a classic buffer copy without checking the size of the input. The program copies data from a command into a fixed size memory area without checking that it fits. Data past the end of that area can overwrite nearby memory, which usually crashes the program and can, depending on the build and platform, change what the program does.
FTP also sends commands in clear text and often runs on machines that were set up years ago and forgotten. A server that reads untrusted commands from the network, was written in a memory unsafe language and has no confirmed fix is a poor match for any host that matters. The TRACE handler is only one entry point of many in the same program.
Try it yourself
This demo shows how exploitability and reachability context change what you fix first.
Click through it at your own pace, or open it full screen.
To see what open source packages your own applications pull in, try the free in-browser dependency scan at gold.safeguard.sh/scan. It will not detect a standalone Windows program, but it keeps the rest of your inventory visible.
Quick check
Is there a patched version of PCMan FTP Server for this CVE?
The record gives none and I could not confirm one. Check the project source, and if nothing newer exists, replace or isolate the server.
Is CVE-2025-4180 exploited in the wild?
The record says an exploit was disclosed publicly and may be used. It is not on the CISA KEV list, and no advisory I could reach reports active exploitation.
Sources
Last reviewed: 18 October 2026.
