libcurl's ASN1 parser code has the function, used for parsing an ASN.1 Generalized Time field.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Jul 31, 2024 · NIST NVD

   Detected

   libcurl's ASN1 parser code has the function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting

2. Oct 15, 2026 · NIST NVD

   Updated

   libcurl's ASN1 parser code has the function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting

Affected

• cpe haxx/libcurlversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2024-7264

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2024-7264

  30-day exploitation probability 20.2%

  first.org
• NIST NVDVulnerability recordCVE-2024-7264

  libcurl's ASN1 parser code has the function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a getting performed on a pointer t

  nvd.nist.gov

References

• Mailing List · openwall.com
• Vendor Advisory · curl.se
• Vendor Advisory · curl.se
• Reference · github.com
• Exploit · hackerone.com
• Reference · security.netapp.com
• Reference · security.netapp.com