Live › vulnerability › CVE-2026-92388
Go to dashboardWhen an FTP wildcard LIST fails, libcurl keeps its internal listing parser as the write callback, so reusing or duplicating the easy handle crashes the process or reads freed memory. Changing only CURLOPT_WRITEDATA after such a failure can make the parser write server response bytes into application memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use libcurl to run FTP wildcard LIST transfers and reuse or duplicate easy handles after a failed listing are exposed. Programs that never use FTP wildcard matching, or that do not reuse handles, are unlikely to be affected. Fixed-version details are not in the sources.
No product ranges from the sources yet.
curl --version to see the libcurl version in useEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
When an FTP wildcard LIST operation fails, libcurl omits the restoration
path meant for successful listings, leaving the write callback set to the
internal listing parser and the write callback data pointing directly to the
easy handle. Subsequent reuse of this handle triggers an immediate crash, and
cloning it via curl_easy_duphandle() copies this corrupted state into the
duplicate. If the original handle is subsequently freed, executing a transfer
on the cloned handle causes a heap use-after-free read against the dangling
handle reference; alternatively, reusing the original or cloned handle while
changing only CURLOPT_WRITEDATA (and omitting CURLOPT_WRITEFUNCTION)
results in type confusion, forcing the internal parser to interpret incoming
server response bytes into memory at the application-supplied write data
pointer.
This page as .md · .json · in your agent: get_signal("CVE-2026-92388")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.