CVE-2010-20049: Leapware Leapftp

Critical severity, CVSS 9.3. EPSS: 1.1% chance of exploitation in the next 30 days.

LeapFTP < 3.1.x contains a stack-based buffer overflow vulnerability in its FTP client parser. When the client receives a directory listing containing a filename longer than 528 bytes, the application fails to properly bound-check the input and overwrites the Structured Exception Handler (SEH) chain. This allows an attacker operating a malicious FTP server to execute arbitrary code on the victim’s machine when the file is listed or downloaded.

Affected products

• Leapware Leapftp: before 3.2 (fixed in 3.2)

Published 2025-08-20. Last modified 2026-06-16.