CVE-2017-1000254

CVE-2017-1000254 describes a heap out-of-bounds read vulnerability in haxx libcurl, affecting versions introduced after March 2005. When connecting to an FTP server, libcurl's parser for the PWD command's 257 response could fail to null-terminate the directory path if the server's response lacked a closing double quote. This could lead to a crash or incorrect data access when libcurl subsequently uses the malformed path. Rated with a CVSS v3.0 score of 7.5 (HIGH), this vulnerability has a network attack vector and low attack complexity, requiring no privileges or user interaction. The primary impact is high availability, as a malicious FTP server could intentionally cause client crashes, effectively preventing libcurl-based clients from functioning. There is no evidence of active exploitation, and no exploit code is publicly available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.