CVE-2018-14618: Buffer Overflow in cURL 7.61.0-7.61.1

The vulnerability lies in the Curlntlmcoremknt_hash function, which calculates the size of a temporary buffer used during NTLM authentication. An attacker can trigger an integer overflow by providing a password longer than 2GB (2^31 bytes) on 32-bit systems. This overflow results in an undersized buffer being allocated, leading to a write beyond the allocated memory when the password is processed. Successful exploitation could lead to a denial-of-service condition by crashing the cURL process. While direct code execution is less likely, the potential for memory corruption raises concerns about more complex exploitation scenarios, particularly in environments where cURL is integrated with other sensitive components. Similar integer overflow vulnerabilities have historically been exploited to achieve arbitrary code execution.

1. Reserved2018-07-27
2. Published2018-09-05
3. Modified2026-04-15

The primary mitigation is to upgrade to cURL version 7.61.2 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Disabling NTLM authentication entirely, if possible, is a strong mitigation. Alternatively, implement strict input validation on the password length before passing it to the NTLM authentication functions. Network firewalls or proxy servers can be configured to block connections using NTLM authentication. Monitor system logs for unusual activity related to cURL, such as crashes or unexpected network connections. No specific Sigma or YARA rules are readily available for this vulnerability, but monitoring for memory corruption patterns in cURL processes could be beneficial.