CVE-2025-5550: High PBSZ Overflow in FreeFloat FTP Server

CVE-2025-5550 is a high severity (7.3) buffer overflow in the PBSZ command handler of FreeFloat FTP Server 1.0, reachable over the network. The record names no fixed version, so the practical answer is to take the server off untrusted networks and move to a maintained FTP or SFTP service.

What's affected

The record lists one product and one version: FreeFloat FTP Server 1.0. The weak spot is the PBSZ command handler, which is the code that parses the PBSZ command sent by an FTP client. The description says the manipulation leads to a buffer overflow and that the attack may be started remotely.

The record does not name a fixed or patched version, and the references point to a VulDB entry and a public exploit write-up rather than a vendor advisory. That is a signal, not a guarantee. If the vendor has published a newer build, its own page is the place to confirm it. Do not assume a later version number is safe unless the vendor says so.

The record does not flag this CVE as exploited in the wild on the CISA KEV list. It does say that an exploit has been disclosed to the public, which means the details are available to anyone who looks.

How to check if you're exposed

This is a standalone Windows style FTP server, not a package from a registry, so a dependency scanner will not list it. Check the places where it would show up.

1. Search your asset inventory and installed software lists for "FreeFloat".
2. On hosts you manage, look for a running FTP service and the program behind it. On Windows, Get-Service and Get-Process in PowerShell will show the executable name and path.
3. From a trusted network position, list hosts that answer on TCP port 21 and compare them with what you expect to run FTP.
4. Read the version banner your FTP service reports to a client, and compare it with the version in the record.

Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It is built for package manifests, so it will not see a standalone server or a PHP project you downloaded as a zip. For those, an asset inventory of what you run is the starting point.

What to do now

1. Find every FreeFloat FTP Server 1.0 instance, including test machines and old lab hosts.
2. Block port 21 and the passive data port range from the internet and from untrusted segments at the firewall.
3. If the service is still needed, restrict it to named source addresses or put it behind a VPN.
4. Plan the replacement. Move transfers to SFTP or another maintained server that still receives security updates.
5. Check the vendor site for a newer build and read its notes before trusting any claim that this issue is fixed.
6. Review the FTP logs for oddly long commands or repeated crashes of the service, and treat a crash as something to investigate.

Why it matters

The class is CWE-119 and CWE-120: copying input into a fixed size memory buffer without checking its length. When a network service does that while parsing a command, a long or malformed command can corrupt memory. Depending on the build and the host, that can crash the service or, in the worse case, change what the process executes. The advisory text in the record does not go further than the overflow, and neither do we.

FreeFloat FTP Server has a run of near identical findings, one per command handler. That pattern points at the parsing code as a whole, not one bad line. Patching a single command would not mean the others are sound, which is another reason to replace the product instead of waiting for point fixes.

Old single purpose servers tend to stay alive because a script or a partner still uses them. They are easy to forget in an inventory and hard to patch when no maintainer answers. Knowing they exist is the first step.

Quick check

Sources

• https://vuldb.com/?ctiid.311000 (listed in the CVE record)
• https://vuldb.com/?id.311000 (listed in the CVE record)
• https://vuldb.com/?submit.586987 (listed in the CVE record)
• Safeguard Gold entry for CVE-2025-5550

Last reviewed: 18 October 2026.