Forum Discussion
libcurl vulnerabilities
Hi InsightCanvas - The libcurl.dll files you're seeing are bundled with third-party Simba ODBC drivers that ship with Power BI Desktop and the On-premises Data Gateway. Vulnerability scanners often flag these based on the library version, but whether a specific CVE is exploitable depends on how the driver uses the affected functionality.
1. Open a Microsoft Support ticket if the issue requires an official security assessment or remediation timeline.
2. Monitor the monthly Power BI Desktop and On-premises Data Gateway release notes for updates to bundled drivers and security fixes.
3. Validate whether the reported CVEs are actually applicable to your deployment, as version-based scanner findings can sometimes be false positives if the vulnerable code paths are not used.Until Microsoft publishes an official advisory or release, any timeline for updating the bundled libcurl libraries would be speculative.
Hope this helps.
Community SupportFollowing up to confirm if the earlier responses addressed your query. If not, please share your questions and we’ll assist further.