CVE-2016-9586: haxx curl Heap-based Buffer Overflow

Vulnerability summary

CVE-2016-9586 is a high (CVSS 8.1) Heap-based Buffer Overflow vulnerability in haxx curl. EPSS estimates a 4.75% chance of exploitation in the next 30 days, higher than 91.8% of scored vulnerabilities.

Timeline

1. 23-04-2018
   PublishedVulnerability first disclosed.
2. 15-04-2026
   Last modifiedVulnerability information updated.

Description

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.

• CWE-122Heap-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the heap.
• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.