CVE-2019-3822

CVE-2019-3822 is a critical stack-based buffer overflow vulnerability affecting libcurl versions 7.36.0 to before 7.64.0, impacting products from vendors like Canonical, Debian, and Oracle. The flaw exists in the NTLM type-3 header generation, where an incorrect unsigned math check allows an attacker-controlled, large NTLMv2 response to overflow a local buffer. This vulnerability carries a CVSS score of 9.8 (Critical), indicating a network-exploitable flaw with no user interaction required, leading to high impacts on confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness and potential for future exploitation.