Multiple heap-based buffer overflows in FTP Desktop client 3.5 and possibly earlier versions allow remote malicious servers to execute arbitrary code via (1) a long FTP banner (2) a long response to a USER command or (3) a long response to a PASS command.