Curl and Libcurl - Vulnerability

Question

Good afternoon!
We have reported 3 vulnerabilities in our environment related to the Curl and libcurl versions. Most machines have version 8.10.1.0 in the files located in the paths %windir%\System32\ and %windir%\SysWOW64.
To resolve the vulnerability, it is necessary to update the version to 8.12.0, but the latest update for Windows 10 and Windows 11 is updating to version 8.11.1.
Is there a forecast for the release of an update for version 8.12?
Below are the CVEs:

CVE-2025-0725 - Successful exploitation of this vulnerability may cause Integer Overflow to Buffer Overflow. - https://curl.se/docs/CVE-2025-0725.html
CVE-2025-0167 - Successful exploitation of these vulnerabilities impacts confidentiality, integrity and availability - Https://curl.se/docs/CVE-2025-0167.html
CVE-2025-0665 - Successful exploitation of these vulnerabilities impacts confidentiality, integrity and availability - https://curl.se/docs/CVE-2025-0665.html

Answer 1

I opened a premier case on this and will try to report on what MS says.

Answer 2

Hello,

I fully agree with Bruno. If Microsoft is bundling and delivering systems with Curl, which contains a known vulnerability and a newer, fixed version is already available, then Microsoft should provide a patch to replace the affected Curl versions with 8.12 or higher as soon as possible. Why is this not happening??

Thank you and have a nice day.

David

Answer 3

Last response on my case was "we currently don't have a definitive timeline for a scheduled fix to release cURL 8.12.1 on Windows Server 2019 and Windows Server 2022" on May 5th.

Answer 4

I opened a premier case on this and will try to report on what MS says.

Thank you, Joe W.

I truly appreciate your going after 'the fine folks in Redmond' on this, as we all should ;-) We are still searching for a statement from them, anything to the affect of, "... and we are working on this with a target availability date of xx/xx/xxxx" Has anyone stumbled over a statement like this? We all have vulnerabilities we're looking to close up.

Thanks, all.

Mark Levigne
Medina, Ohio; USA

Answer 5

That's a valid question. However:

1- No one here knows about Microsoft's plans. This is a community forum. No one is employed by or represents Microsoft.

2- Microsoft Community is primarily for individual users who can't stop their PCs from crashing and need extensive handholding.