source: https://www.securityfocus.com/bid/38897/info

Cafu is prone to a remote NULL pointer dereference vulnerability and a remote client format string vulnerability.

Successful exploits may allow an attacker to execute arbitrary code within the context of the affected application or crash the affected application, resulting in a denial-of-service condition.

Cafu 9.06 and prior are vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33786.zip