Enabling CURLOPT_CRLF causes curl to advertise the raw input byte count in the IMAP APPEND {N} literal while transmitting line‑ending expanded data. Because the server reads only the announced N bytes as the payload, the remaining overflow bytes become valid IMAP commands that are executed within the authenticated session. This boundary‑error flaw (CWE‑130) allows an attacker who controls the data sent through curl to inject arbitrary IMAP commands, potentially compromising the server's confidentiality, integrity, or availability. Based on the description, it is inferred that the attack exploits a size‑mismatch in the IMAP protocol that manifests only when CRLF conversion is enabled.

The flaw affects any installation of curl that performs CRLF conversion during IMAP APPEND operations. No specific version range is provided in the advisory, so all curl releases that enable this feature are potentially impacted until the upstream code receives a fix.

The CVSS score of 8.1 reflects high severity, while the EPSS score of <1% and absence from the KEV catalog indicate a low probability of widespread exploitation. Based on the description, it is inferred that the attacker must be able to control the payload sent via curl to a victim server that accepts the IMAP APPEND command, and the vulnerability is only exploitable within authenticated sessions. Nevertheless, because injected commands could be arbitrary, the risk to the affected system is significant if the attack vector is realized.