CVE-2025-5219 is a high severity buffer overflow (CVSS 7.3) in the ASCII command handler of FreeFloat FTP Server 1.0.0. A remote client can trigger it, and the record says an exploit is public. No fixed version is listed, so retire the server or keep it off untrusted networks.
What's affected
The record names FreeFloat FTP Server 1.0.0 and the ASCII Command Handler component. The weakness is classed as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-120 (classic buffer copy without checking input size).
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That reads as network reachable, low attack complexity, no privileges and no user interaction, with low scores for confidentiality, integrity and availability. The record says an exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false.
No fixed version appears in the record. FreeFloat FTP Server 1.0.0 has several other overflow CVEs in the same range, including CVE-2025-5217, CVE-2025-5218, CVE-2025-5220, CVE-2025-5221. Each one is a separate command handler. Treat the product as unfit for use on exposed networks and do not wait for a patch that may not arrive.
How to check if you're exposed
Find out whether the server runs anywhere you own. On Windows, look for the process and the FTP port:
Get-Process | Where-Object { $_.ProcessName -like "*freefloat*" }
netstat -ano | findstr ":21"
On a scanner or network inventory, search for FTP banners that mention FreeFloat. If you do not know whether anyone installed it, a file name search is a reasonable second step:
Get-ChildItem C:\ -Recurse -Filter "*freefloat*" -ErrorAction SilentlyContinue
Then check who can reach port 21 on that host. A firewall rule that only allows a few known addresses changes the risk a lot compared with an open rule. Review the Windows event log for application crashes of the FTP process, since a failed memory write often shows up as a crash before anything else.
What to do now
- Locate every FreeFloat FTP Server install, including old lab machines, file drop boxes and forgotten test servers.
- Block inbound FTP to those hosts from untrusted networks now, at the firewall and at the host.
- Migrate transfers to a maintained server that supports SFTP or FTPS, then uninstall FreeFloat.
- If you must keep it running for a short time, put it in an isolated network segment, run it under a low privilege account, and allow only named client addresses.
- Turn on process crash alerts for the host and keep its logs, so repeated crashes of the FTP process get noticed.
- Remember the related CVEs (CVE-2025-5217, CVE-2025-5218, CVE-2025-5220, CVE-2025-5221). Removing the product closes all of them, while patching one handler would not.
Why it matters
A buffer overflow happens when a program copies more data than a fixed block of memory can hold. The extra bytes land on neighbouring memory and can crash the process or, with enough skill, change what the program does. Memory safety bugs in network daemons are serious because an attacker only needs to reach the port.
The record names an ASCII command handler, which deals with the transfer mode setting. A mode switch looks harmless, yet any code that copies client supplied text into a fixed buffer can fail.
The pattern across these CVEs matters more than any single one. When one product has overflow bugs in many command handlers, it points to input handling that was never designed for hostile clients. The safest fix is to stop running it, not to chase each handler. FTP also sends credentials and data in the clear, so even a patched plain FTP server is a weak choice on untrusted networks.
Quick check
Does CVE-2025-5219 have a fix?
The record lists no fixed version for FreeFloat FTP Server 1.0.0. Remove the product or isolate it, and check the project pages if you want to confirm there is no newer release.
Is this exploited in the wild?
The record says an exploit has been disclosed to the public, but the CISA Known Exploited Vulnerabilities flag is false. Public exploit code makes opportunistic scanning likely, so do not treat a low KEV signal as safety.
Sources
- Safeguard Gold record: https://gold.safeguard.sh/vulnerability/CVE-2025-5219
- CVE record data for CVE-2025-5219, including the VulDB entry and the public exploit listing it references. Those pages could not be retrieved while this post was written, and no exploit details are reproduced here.
Last reviewed: 18 October 2026.
