libcurl EUVD-2026-72164

Exploitation requires the attacker to achieve Man-in-the-Middle network positioning between the libcurl client and the LDAP server - for example via ARP poisoning, rogue DNS, or network layer adjacency. Beyond network positioning, the target application must specifically use libcurl's LDAP protocol handler with SASL-based authentication; applications using curl for HTTP, FTP, SMTP, or any non-LDAP scheme are not exposed to this code path. If LDAP traffic is encapsulated in a separately validated TLS tunnel (LDAPS), the attacker must additionally defeat that TLS channel before the SASL bypass is reachable. No authentication to the target system is required on the attacker's part (PR:N). The CVSS AC:H metric directly encodes the MITM prerequisite as the primary complexity driver.

The CVSS 7.4 score and AC:H metric correctly capture the central limiting factor: successful exploitation demands active Man-in-the-Middle network positioning, which is a meaningful barrier in most modern environments where network segments are isolated or monitored. The EPSS of 0.27% (18th percentile) is consistent with a technically credible but operationally difficult-to-exploit class of vulnerability - the LDAP-with-SASL code path is exercised by only a subset of libcurl deployments, and passive or opportunistic network scanning cannot trigger it. No public exploit has been identified and there is no CISA KEV listing, making this a patch-cycle rather than emergency-response priority for most organizations. That said, the C:H/I:H impact metrics are not overstated: a successful bypass yields full control over what the client believes is an authenticated LDAP session, enabling credential interception and directory data injection that can cascade into broader compromise in LDAP-integrated environments. The combination of ubiquitous library deployment and a specific high-value protocol makes this worth patching promptly, even though the real-world exploitation window is narrower than the raw score suggests.

An attacker with network adjacency to the path between a libcurl-based application and its LDAP server - achieved via ARP spoofing, rogue DNS, or physical access to a shared network segment - intercepts the SASL handshake and responds to the server's challenge with a synthetic early-completion message. libcurl misinterprets the truncated exchange as successful peer verification and proceeds with what it believes is a validated authenticated session, now fully controlled by the attacker. The attacker can then return crafted LDAP query responses, inject false directory entries (e.g., spoofed group memberships or credentials), or passively capture authentication tokens sent over the session. No public exploit code has been identified at time of analysis.