thc-hydra versions up to 9.7 contain a stack buffer overflow vulnerability in the NTLM authentication implementation across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, which causes the base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes. This overflow can enable remote code execution on systems that do not have stack protection mechanisms. The vulnerability was fixed in a commit identified as 9cc84c2, which is after version 9.7. The CVSS 4.0 score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a remote attacker controlling a malicious server to execute arbitrary code on the client system running vulnerable versions of thc-hydra without requiring privileges. This can compromise confidentiality, integrity, and availability of the affected system. Exploitation requires user interaction and no authentication, making it a significant risk especially on systems without stack protection.

A fix is available in the commit identified as 9cc84c2, which addresses the buffer overflow vulnerability. Users should upgrade to a version of thc-hydra that includes this fix, i.e., any version later than 9.7. Since this is not a cloud service, remediation depends on applying the updated software version. Patch status is confirmed by the vendor commit reference. Until patched, avoid connecting to untrusted servers that use NTLM authentication.