The vulnerability is a stack overflow in libcurl caused by excessive recursion during cleanup of a deeply nested multipart MIME structure. Constructing such a structure via the public API triggers unbounded stack frame allocation while `curl_mime_free` traverses the MIME hierarchy, ultimately crashing the host process. This weakness is identified as CWE‑674, representing uncontrolled recursion.

The vulnerability affects any software that links against the libcurl library, the product provided by the curl vendor. Applications that process deeply nested multipart MIME content via libcurl are potentially impacted.

The CVSS score of 7.5 indicates a high overall severity for the flaw, and the EPSS score of 0.00358 (<1%) shows a very low exploitation probability. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is network‑based delivery of malicious MIME data to a target application that utilizes libcurl for cleanup. Attack prerequisites would include the ability to send a specially crafted MIME payload to the vulnerable application. The high CVSS score reflects the impact as a denial of service rather than data exposure or privilege escalation. The lack of a KEV listing suggests there are no widely reported exploitation incidents at this time.