CVE-1999-0671: Buffer overflow in ToxSoft NextFTP client through CWD command.

Security readout for executives and security teams

An old flaw in the ToxSoft NextFTP client lets a malicious FTP server send an oversized directory-change (CWD) response that overwhelms the client's memory buffer. In plain terms, simply connecting the NextFTP client to a hostile or compromised FTP server could crash the program or potentially let the server run code on the user's PC. The bug dates to 2000 and affects a niche legacy Windows FTP client, so business impact today is limited to users still running it. Exposure is minimal in modern enterprises. NextFTP is a legacy Windows FTP client with limited historical distribution, and this defect is client-side, requiring the user to connect to a malicious or compromised FTP server. Organizations that have retired FTP clients or moved to SFTP/HTTPS transfers are effectively unaffected. Any lingering exposure would sit on developer, admin, or legacy workstations still running the ToxSoft client. Low priority. This is a 25-year-old flaw in a niche legacy FTP client with no known active exploitation and no CISA KEV listing. Treat it as hygiene: confirm the software is not present, and if it is, replace it with a modern, supported secure file-transfer client during normal IT lifecycle work. Mitigation focus: Inventory endpoints for ToxSoft NextFTP and remove or replace it with a maintained SFTP/FTPS client.; Restrict outbound FTP (TCP/21) to a short allow-list of known, trusted servers.; Check ToxSoft vendor guidance for any updated NextFTP release before continuing use..

Prepared

Jul 12, 2026, 01:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.