Use-after-free in cURL - CVE-2026-92388
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service and corrupt memory.
The vulnerability exists due to use-after-free and type confusion in libcurl's FTP wildcard write callback handling when reusing or cloning an easy handle after a failed FTP wildcard LIST operation. A remote attacker can supply server response bytes that are processed through the incorrectly retained internal listing parser to cause a denial of service and corrupt memory.
Exploitation requires CURLOPT_FTP_WILDCARD to be enabled. The use-after-free read occurs when the original handle is freed before a transfer executes on its duplicate. Type confusion occurs when the application changes CURLOPT_WRITEDATA without also changing CURLOPT_WRITEFUNCTION. The curl command-line tool is not affected.