It is rumored to be remotely exploitable.
Systems running ftpd are vulnerable.
As of the release date of this advisory, all of past NetBSD releases, including NetBSD 1.5, are vulnerable. It contained an erroneous bounds check. We need to replace it to fix the problem. If you do not run ftpd on your system, you system is not vulnerable. We suggest you to apply the fix anyways, in case you want to run ftpd in the future.