CVE-2025-0725

What it actually does

Integer overflow during automatic gzip decompression of HTTP responses when CURLOPT_ACCEPT_ENCODING is enabled with zlib 1.2.0.3 or older, resulting in a heap buffer overflow in libcurl.

Why it matters to the business

Attackers could execute arbitrary code on systems using affected libcurl versions, leading to potential data breaches, service disruption, or full system compromise; the rising exploit probability increases urgency for organizations relying on curl-based tools or libraries.

How an attack unfolds

An attacker positions a malicious HTTP server that returns a specially crafted gzip-encoded response. When a vulnerable libcurl client requests the resource with automatic decompression enabled, the integer overflow occurs during zlib processing and overwrites memory, allowing code execution.

How to fix it

Upgrade libcurl to the version containing commit 76f83f0db23846e254d940ec7 or later; if an upgrade is not immediately possible, disable CURLOPT_ACCEPT_ENCODING or ensure a newer zlib version (>1.2.0.3) is linked.

How to confirm the fix worked

Verify the installed libcurl version reports the fix commit or later; test by sending gzip responses while monitoring for crashes or unexpected memory behavior; confirm zlib linkage is newer than 1.2.0.3.

Typical attack path

1. Identify target applications or scripts that use libcurl with CURLOPT_ACCEPT_ENCODING enabled
2. Host or compromise a web server returning malicious gzip-compressed HTTP responses
3. Trigger the client to fetch the resource, causing the integer-to-buffer overflow during decompression
4. Leverage the resulting memory corruption to execute attacker-controlled code or crash the process

How to detect it

Review application logs for crashes or segmentation faults during HTTP response handling; inspect process memory dumps or core files around zlib decompression routines; correlate with outbound requests that accept gzip encoding.

What your security team should do

• Prioritize patching libcurl in all environments within the next 30 days given the 42% EPSS increase
• Inventory applications and dependencies that link against libcurl and enable automatic content decoding
• Apply the fixed commit 76f83f0db23846e254d940ec7 or equivalent release across the fleet
• Temporarily disable automatic decompression where feasible until patches are deployed