CVE-2025-5053 is a high severity (CVSS 7.3) buffer overflow in the MDIR command handler of FreeFloat FTP Server 1.0. The record says it can be reached remotely and that exploit details are public. No fixed version is confirmed, so retire the server or keep it off any untrusted network.
What's affected
FreeFloat FTP Server version 1.0, per the record. The vulnerable code is the handler for the MDIR command. The record does not describe the exact function and does not give a patched release.
The references are a VulDB entry and a public exploit listing. There is no vendor advisory among them, and I could not confirm that the vendor still ships updates. Check the vendor's site before assuming a fix exists, and treat every copy of version 1.0 as vulnerable until you know otherwise.
The same product has near identical entries for other commands: CVE-2025-5073 (MKDIR), CVE-2025-5074 (PROMPT), CVE-2025-5075 (DEBUG), CVE-2025-5076 (SEND), CVE-2025-5109 (STATUS), CVE-2025-5110 (VERBOSE), CVE-2025-5111 (TYPE), CVE-2025-5112 (MGET).
How to check if you're exposed
Start with an inventory. FreeFloat FTP Server runs on Windows, often as a leftover from an old file transfer job. On a Windows host you can search for the executable:
Get-ChildItem -Path C:\ -Recurse -Filter "*freefloat*" -ErrorAction SilentlyContinue
Then find which hosts answer on the FTP port. Only scan networks you own or have written permission to test:
nmap -sV -p 21 --open 10.0.0.0/24
The service banner often names the product. If you find a match, check whether the port is open to the internet, and ask who still depends on it.
Reachability analysis helps with libraries, because it asks whether your code actually calls the vulnerable function. For a standalone server product like this one, the question is simpler: is it installed, and can anyone reach it?
What to do now
- List every FreeFloat FTP Server in your estate and the process that uses it.
- Ask the vendor whether a fixed build exists. If the answer is no or nothing comes back, plan the replacement.
- Move the transfer job to a maintained server that supports encrypted transfer such as SFTP.
- Until then, block port 21 from the internet and allow only the specific source addresses that need it.
- If the host was exposed, review it for unexpected processes, new accounts and odd outbound connections.
Why it matters
The record classifies this as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-120 (Classic Buffer Overflow). A buffer overflow happens when a program copies input into a fixed-size block of memory without checking that it fits. The extra bytes spill into neighbouring memory, and depending on the build and platform that can mean a crash or a change in what the program executes. The record rates the impact as low for confidentiality, integrity and availability, so the score is 7.3 rather than higher.
Nine separate FreeFloat command handlers received their own CVE in the same week of May 2025. That pattern says more than any single entry. If one handler lacks a length check, the others probably do too, and patching them one by one is not a plan.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild. It does say the exploit has been disclosed publicly, which lowers the effort for anyone who finds an exposed server. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan, which checks the packages your own projects use against the Gold directory. It will not find a commercial product installed on a server, so pair it with an inventory of what runs where.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for FreeFloat FTP Server 1.0?
I could not confirm one from the sources available. The record lists no fixed version, so check with the vendor and plan to replace the server.
Does an attacker need an account to reach the MDIR handler?
The record says the attack can be launched remotely, and the CVSS vector lists no privileges required. The record does not spell out the login state, so do not rely on authentication as a defence.
Sources
Last reviewed: 18 October 2026.
