CVE-2018-16890: Heap Buffer Overflow in libcurl

An attacker could exploit this vulnerability by crafting a malicious NTLM type-2 response that triggers an integer overflow within ntlmdecodetype2_target. This overflow results in a buffer read out-of-bounds, potentially allowing the attacker to read sensitive data from memory or even execute arbitrary code. The impact is particularly significant for applications that rely on libcurl for network communication and handle NTLM authentication. While the CVSS score is MEDIUM (5.4), the potential for code execution elevates the risk, especially in environments where libcurl is used to access sensitive data or interact with untrusted networks. Similar integer overflow vulnerabilities in other libraries have led to remote code execution, highlighting the severity of this issue.

1. Reserved2018-09-11
2. Published2019-02-06
3. Modified2026-04-15

The primary mitigation for CVE-2018-16890 is to upgrade to libcurl version 7.64.0 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to NTLM authentication or validating NTLM responses on the server-side. Web application firewalls (WAFs) configured to inspect NTLM traffic could potentially detect and block malicious requests. Monitor libcurl logs for unusual activity or errors related to NTLM authentication. After upgrading, confirm the fix by attempting to reproduce the vulnerability with a known malicious NTLM payload and verifying that the buffer overflow is no longer triggered.