CVE-2016-4802: Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with SSPI or t...

Security readout for executives and security teams

This vulnerability lets a local user trick vulnerable cURL or libcurl into loading a malicious DLL from an application or working directory. It is not described as a remote internet attack. The business risk is highest for legacy Windows deployments, bundled copies of libcurl, or software run from directories writable by non-admin users. Exposure is likely limited to systems using cURL/libcurl before 7.49.1 with SSPI or telnet support, especially Windows contexts where DLL search order matters. Bundled third-party copies may be easier to miss than system packages. Treat this as a legacy exposure cleanup item, not an emergency remote-exploitation event based on available evidence. Prioritize assets with old bundled libcurl, Windows deployments, shared workstations, and environments where local users can write into application paths. Mitigation focus: Upgrade cURL/libcurl to 7.49.1 or later where affected builds exist.; Check vendor guidance for applications bundling their own libcurl copy.; Disable unnecessary telnet support in builds where feasible..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.