CVE-2010-3972

CVE-2010-3972 describes a critical heap-based buffer overflow vulnerability in the Microsoft FTP Service 7.0 and 7.5, affecting Internet Information Services (IIS) 7.0 and 7.5. This flaw, located in the TELNET_STREAM_CONTEXT::OnSendData function within ftpsvc.dll, allows unauthenticated remote attackers to execute arbitrary code or trigger a denial of service by sending a specially crafted FTP command. The vulnerability carries a maximum CVSS score of 10.0, indicating a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. Its high EPSS score of 0.88249 further highlights its exploitability potential. While not listed on CISA's KEV catalog, exploit intelligence shows a Metasploit auxiliary module exists, and a proof-of-concept for denial of service is available on ExploitDB. Despite this, there is no recorded community discussion or media coverage, suggesting it may not be widely discussed or actively exploited in the wild at present.