I'm confused why plain 'curl' would crash here: the CVE says that "The target buffer is the heap-based download buffer in libcurl that is reused for SOCKS ne

I'm confused why plain 'curl' would crash here: the CVE says that "The target buffer is the heap-based download buffer in libcurl that is reused for SOCKS negotiation before the transfer has started. The size of the buffer is 16kB by default, but can be set to different sizes by the application. The curl tool sets it to 102400 bytes by default - but it sets the buffer size to a smaller size if --limit-rate is set lower than 102400 bytes per second." I thought with a buffer of 100kB, this bug wouldn't trigger?