$ cve CVE-2011-5012 JSON

CVE-2011-5012 EXPLOIT

10.0

HIGH · CVSS 2.0 · EPSS 7.8% (pctl 94)

Patch early

A public exploit exists.

Description

Heap-based buffer overflow in the Reflection FTP Client (rftpcom.dll 7.2.0.106 and possibly other versions), as used in Attachmate Reflection 2008, Reflection 2011 R1 before 15.3.2.569 and R1 SP1 before, Reflection 2011 R2 before 15.4.1.327, Reflection Windows Client 7.2 SP1 before hotfix 7.2.1186, and Reflection 14.1 SP1 before 14.1.1.206, allows remote FTP servers to execute arbitrary code via a long directory name in a response to a LIST command.

Scoring

CVSS	10.0 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS	7.75% — more likely to be exploited than 94% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2011-12-25
Last modified	2026-06-16

Affected (5)

Vendor	Product
attachmate	reflection
attachmate	reflection 2008
attachmate	reflection 2008r1
attachmate	reflection 2008r2
attachmate	reflection 2011r1

Public exploits

Source	Title	Date
exploit-db	Attachmate Reflection FTP Client - Heap Overflow	2011-11-16

References

→ the Explorer · watch your stack · NVD