Vulnerability libcurl - best way to patch or upgrade?

Do not copy a newer libcurl.dll over either detected file; update the owning Office/Salesforce ODBC and Micro Focus packages through their supported servicing channels, because a standalone DLL replacement can break binary dependencies and leave the products unsupported.

The upstream curl release listing currently shows 8.23.0, not 8.32, while 8.21.0 is an earlier release.^1^ More importantly, an upstream curl release number does not prove that a vendor’s bundled DLL is vulnerable or interchangeable with that release. Confirm the scanner finding against the specific CVE and the product vendor’s advisory.

1. Office Salesforce ODBC copy

For:

C:\Program Files\Microsoft Office\root\Office16\
ODBC Drivers\Salesforce\lib\libcurl.dll

1. Record the installed Office build and update channel.
   • Open Word or Excel.
   • Select File > Account.
   • Record the version/build shown under About.
2. Update the complete Office installation.
   • On an unmanaged installation, select File > Account > Update Options > Update Now.
   • Close Office applications if prompted.
   • Restart the server if requested.
   • Recheck the Office build and then rescan the DLL. Microsoft documents this update path for Microsoft 365 Apps.^2^
3. If Configuration Manager controls Office updates, deploy the current package for the server’s existing architecture and update channel. Configuration Manager must have Microsoft 365 Apps/Office 2019/Office LTSC and Updates selected under: Site Configuration > Sites > Configure Site Components > Software Update Point Then synchronize and deploy the applicable Office update.^3^
4. Rescan after the package update. If the same DLL remains, no available evidence establishes that manually installing upstream libcurl 8.21 or 8.23 is a supported remediation for this exact Office Salesforce driver. Open a Microsoft support case with:
   • Office edition, build, channel, and architecture
   • DLL path, file version, and hash
   • Scanner name and plugin
   • Exact CVE—not only “Component”
   • Evidence that the latest supported Office build remains flagged

The available material does not identify an Office/Salesforce ODBC build that specifically replaces this DLL with 8.21.0. Consequently, the scanner’s “fixed version” cannot safely be treated as a package installation instruction.

2. Micro Focus/OpenText licensing copy

For:

C:\Program Files (x86)\Micro Focus\Licensing\libcurl.dll

1. Identify the installed Micro Focus/OpenText licensing product and build in Settings > Apps > Installed apps or Control Panel > Programs and Features.
2. Use the OpenText/Micro Focus Software Licenses and Downloads (SLD) portal to locate an update for that exact licensing product and your entitlement. SLD is the vendor channel for updates, upgrades, downloads, licensing, and version updates.^4^
3. Read that package’s prerequisites and release notes, back up the server or take a supported VM snapshot, and test the complete installer on a non-production system.
4. Stop applications that use the licensing service, install the vendor package, restart as required, validate licensed applications, and rescan.
5. If SLD offers no updated build, submit the exact CVE and DLL details to OpenText support and request the supported fixed product version or mitigation.

Compatibility and validation

Compatibility problems are possible with manual DLL replacement because the bundled library may have vendor-specific build options, dependencies, exports, TLS backend, or calling assumptions. Package-level updates let the owning vendor test those boundaries.

After each supported upgrade:

• Test the relevant Office Salesforce connection using the ODBC Administrator matching the application’s bitness:
  • 64-bit: C:\Windows\System32\odbcad32.exe
  • 32-bit: C:\Windows\SysWOW64\odbcad32.exe
• Confirm the driver appears under Drivers.
• Create or use a test DSN and run a connection test.
• Test applications that depend on Micro Focus licensing.

Microsoft notes that third-party driver behavior, defects, and installation logic remain the driver vendor’s responsibility; supported checks include driver registration, DLL paths, DSN testing, and collecting a Procmon trace for vendor analysis.^5^

If either DLL has already been replaced or deleted manually, restore it using the owning product’s installer. For Office, Installed apps > Microsoft 365/Office > Modify > Online Repair reinstalls the complete Office suite rather than repairing only one component.^6^

References

1. Releases · curl/curl · GitHub
2. KB5002907: Optional update for out-of-date Microsoft 365 Apps installations | Microsoft Support
3. Manage updates to Microsoft 365 Apps with Microsoft Configuration Manager
4. Software Licenses and Downloads - Micro Focus
5. ODBC driver installation check
6. [Windows 11](https://support.microsoft.com/office/lifecycle/repair-an-office-application)