CVE-2020-36617

CVE-2020-36617 is a critical vulnerability affecting the greenend sftpserver, specifically within the sftp_parse_path function in parse.c, which can lead to an uninitialized pointer. With a CVSS score of 9.8 (Critical), it presents a severe risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While the existence of the vulnerability is still debated and it may only be exploitable in specific, explicitly warned-against deployment models, there is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding it.