CVE-2016-8622

CVE-2016-8622 describes a critical heap-based buffer overflow vulnerability in libcurl versions prior to 7.51.0, specifically within the curl_easy_unescape function. This flaw arises when the function attempts to decode a URL percent-encoded string that would result in a destination buffer larger than 2GB, causing the length to be truncated or become negative due to being stored in a signed 32-bit integer. This could lead to libcurl writing outside of its allocated memory. Rated with a CVSSv3 score of 9.8 (Critical), this vulnerability is remotely exploitable with low attack complexity and no user interaction required, potentially leading to complete compromise of confidentiality, integrity, and availability. The affected product is haxx libcurl. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. While there is limited community discussion and media coverage, its critical severity warrants immediate patching.