CVE-2024-7264

Deeper analysis

CVE-2024-7264 affects libcurl's ASN.1 parser, specifically the GTime2str() function responsible for handling Generalized Time fields. When presented with a syntactically invalid field, the code sets the time-fraction length to -1, causing strlen() to read from a heap buffer that is not guaranteed to be null-terminated. The flaw is tracked under CWE-125 and carries a CVSS 3.1 score of 6.5.

An attacker can trigger the issue by supplying a crafted certificate or ASN.1 structure during TLS handshakes or other operations that invoke certificate parsing. Successful exploitation most often produces a crash, but when an application subsequently calls CURLINFO_CERTINFO the same path may return adjacent heap contents to the caller, resulting in limited information disclosure. The attack requires user interaction or a malicious server and needs no privileges on the target system.

The EPSS score for the vulnerability rose from a low baseline to a peak of 0.0536 on 2025-12-11 before receding to its current value of 0.0088, indicating a measurable but temporary increase in exploitation interest after disclosure. Public advisories and patch information are available at the listed curl.se and Openwall references.