CVE-2025-5295 is a high severity (CVSS 7.3) buffer overflow in the PORT command handler of FreeFloat FTP Server 1.0.0. The record says it can be reached remotely and that an exploit has been made public. It lists no fixed version, so the safe choice is to retire the server or isolate it from untrusted networks.
What's affected
The record names FreeFloat FTP Server 1.0.0 and the PORT command handler. The weakness is a classic buffer overflow, listed under CWE-119 and CWE-120.
The record says the attack can be started remotely and that the exploit has been disclosed to the public and may be used. It does not mention a vendor response, a patch or a newer release, and I could not confirm any fixed version from the references. Do not assume one exists. If you need an answer for this exact product, look for a vendor statement and treat the lack of one as a reason to move off the software.
The same product has had other overflow bugs in other FTP commands reported over the years, so the PORT handler is one of several weak spots in the code.
How to check if you're exposed
Start by finding the software. FreeFloat FTP Server is a small Windows program, often run by hand or as a service on a lab machine, a test box or an old file transfer host. Search your asset list and your endpoint inventory for the executable name, and ask teams who run legacy file transfer.
On a Windows host that you suspect, check whether an FTP listener is active:
netstat -ano | findstr :21
Match the process id to the program that owns it. Also check your firewall rules and port forwards for traffic to port 21 that ends on that machine. If the version is 1.0.0, the host is in scope.
What to do now
- Locate every FreeFloat FTP Server instance and confirm its version.
- If it is not essential, stop and uninstall it.
- If it must stay for now, block port 21 and the passive port range at the network edge and allow only named client addresses.
- Plan a move to a maintained file transfer service that supports encrypted transfer, and migrate the users.
- Review the host for signs of compromise if it was ever internet facing, since the exploit is public.
Why it matters
A buffer overflow happens when a program copies data into a fixed size area of memory without checking the length. Data that is too long spills over into neighbouring memory, and in the worst case an attacker steers the program into running their own code. FTP servers parse many short commands from unauthenticated clients, which makes each command handler a place where a length check can go missing.
The record does not mention use in attacks, and the CVE is not on the CISA Known Exploited Vulnerabilities list. What it does say is that an exploit is public. With a public exploit and no patch, the risk comes down to how reachable the service is, which is something you control.
Quick check
Is there a patch for FreeFloat FTP Server 1.0.0?
None is listed in the record or its references. Treat the product as unmaintained and remove or isolate it unless the vendor says otherwise.
Sources
Last reviewed: 18 October 2026.
