The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0 when built for Windows CE using the schannel TLS backend allows remote attackers to obtain sensitive information cause a denial of service (crash) or possibly have unspecified other impact via a wildcard certificate name which triggers an out-of-bounds read.