CVE-2025-5049 is a high severity (CVSS 7.3) buffer overflow in the APPEND command handler of FreeFloat FTP Server 1.0. The record says it can be triggered remotely and that the exploit is public. No fixed version is confirmed, so the safe plan is to retire the server or lock it down to trusted addresses.
What's affected
FreeFloat FTP Server 1.0, per the record. The affected component is the APPEND command handler. The record describes the attack as remote and says the exploit has been disclosed publicly.
The record names no fixed version and no vendor advisory. Its references are an exploit listing and VulDB entries. I could not confirm that a patched release exists, so check whether the vendor still maintains the product before planning around an update.
This is one of several overflow reports filed against the same server in the same week, including CVE-2025-5050, CVE-2025-5051 and CVE-2025-5052. Each covers a different command, which suggests the whole command parser deserves distrust, not one function.
How to check if you're exposed
Find FreeFloat on Windows hosts through installed programs and by searching for the server executable on disk. Then find hosts that answer on the FTP port in networks you manage:
nmap -sV -p 21 --open 10.0.0.0/24
Replace the range with your own. The service banner in the output often names the product. Only scan networks you own or have permission to test.
Next, check whether port 21 is forwarded from the internet on your firewall or router, and who actually depends on the server.
What to do now
- Locate every FreeFloat FTP Server and the process that relies on it.
- Confirm with the vendor whether a fixed build exists. If not, plan to retire it.
- Move the transfer job to a maintained server that supports encrypted transfer.
- Until then, block port 21 from the internet and allow only the specific addresses that need access.
- Run the service under a low privilege account, not an administrator.
- Review the host for unexpected processes, new accounts or files if it was ever exposed.
Why it matters
The weakness is CWE-119, a failure to keep memory operations inside the bounds of a buffer, together with its child CWE-120, where input is copied into a buffer without checking its size. In a network service, a long or malformed command can overwrite adjacent memory. The usual outcomes are a crash, and in the worst cases attacker controlled code running with the service's rights.
An old FTP server like this is often forgotten, which is the real exposure. Nobody patches it because nobody remembers it is there. The record's KEV flag is false, so this is not listed as exploited in the wild, but a public exploit listing lowers the effort for anyone who finds the port open.
Quick check
Is there a patch for CVE-2025-5049?
No fixed version is confirmed in the record. Check the vendor, and plan to replace the server if it is no longer maintained.
Is blocking port 21 enough?
It removes the internet exposure, which is the largest part of the risk. Internal users can still reach the service, so restrict it to the hosts that need it and plan the replacement.
Sources
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in projects you manage.
Last reviewed: 18 October 2026.
