CVE-2025-5356 is a high severity (CVSS 7.3) buffer overflow in the BYE command handler of FreeFloat FTP Server 1.0. The record says it can be reached remotely and that an exploit has been made public. It lists no fixed version, so retire the server or isolate it from untrusted networks.
What's affected
The record names FreeFloat FTP Server 1.0 and the BYE command handler. The weakness is a classic buffer overflow, listed under CWE-119 and CWE-120.
The record says the attack can be started remotely and that the exploit has been disclosed to the public and may be used. It does not mention a patch or a newer release, and I could not confirm any fixed version from the references. Do not assume one exists.
BYE is a command a client sends to end a session, so the handler runs on every connection. That a closing command could overflow a buffer shows how little input checking the product does. Other handlers in the same product have had similar reports.
How to check if you're exposed
Start by finding the software. FreeFloat FTP Server is a small Windows program, often run by hand or as a service on a lab machine, a test box or an old file transfer host. Search your asset list and endpoint inventory for the executable, and ask teams that run legacy file transfer.
On a Windows host you suspect, check whether an FTP listener is active:
netstat -ano | findstr :21
Match the process id to the program that owns it. Also review firewall rules and port forwards for traffic to port 21 that ends on that machine. If the version is 1.0, the host is in scope.
What to do now
- Locate every instance of FreeFloat FTP Server and confirm its version.
- If it is not essential, stop and uninstall it.
- If it must stay for now, block port 21 and the passive port range at the network edge and allow only named client addresses.
- Plan a move to a maintained file transfer service that supports encrypted transfer, and migrate the users.
- If the host was ever internet facing, review it for signs of compromise, since the exploit is public.
Why it matters
A buffer overflow happens when a program copies data into a fixed size area of memory without checking the length. Data that is too long spills into neighbouring memory, and in the worst case an attacker steers the program into running their own code. FTP servers parse many short commands from clients before login, which makes each command handler a place where a length check can go missing.
The record does not mention use in attacks, and the CVE is not on the CISA Known Exploited Vulnerabilities list. It does say an exploit is public. With a public exploit and no patch, the risk comes down to how reachable the service is, and that is something you control.
Quick check
Is there a patch for FreeFloat FTP Server 1.0?
None is listed in the record or its references. Treat the product as unmaintained and remove or isolate it unless the vendor says otherwise.
Sources
Last reviewed: 18 October 2026.
