CVE-2026-92388

Name of the Vulnerable Software and Affected Versions libcurl versions prior to 8.23.0-1.1

Description A failure during an FTP wildcard LIST operation prevents the restoration of the write callback, leaving it set to the internal listing parser and the write callback data pointing to the easy handle. Reusing this handle can cause an immediate crash. Cloning the handle via curl easy duphandle() propagates this corrupted state. If the original handle is freed, using the cloned handle leads to a heap use-after-free read. Additionally, reusing the original or cloned handle while updating only CURLOPT WRITEDATA without updating CURLOPT WRITEFUNCTION causes type confusion, where the internal parser writes server response bytes into the memory location specified by the application-supplied write data pointer.

Recommendations Update to version 8.23.0-1.1.