UBUNTU-CVE-2026-92388: Use After Free
When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via curleasyduphandle() copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only CURLOPTWRITEDATA (and omitting CURLOPTWRITEFUNCTION) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.35.0-1ubuntu2.20+esm24 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.47.0-1ubuntu2.19+esm21 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.58.0-2ubuntu3.24+esm15 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.68.0-1ubuntu2.25+esm10 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 7.81.0-1ubuntu1.30 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.5.0-2ubuntu10.16 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8
Event History
Frequently Asked Questions
What application behavior is required to reach the vulnerable state?
An application must perform an FTP wildcard LIST operation that fails. The affected easy handle must then be reused or duplicated for the crash, use-after-free, or type-confusion conditions to occur.
When can this become a use-after-free rather than an immediate crash?
The application must clone the affected handle with curl_easy_duphandle(), free the original handle, and then execute a transfer using the clone. The clone retains a dangling reference to the freed original handle.
What reuse pattern can lead to type confusion?
After the failed FTP wildcard LIST operation, reuse either the original or cloned handle while setting CURLOPT_WRITEDATA but not CURLOPT_WRITEFUNCTION. This leaves libcurl's internal listing parser installed as the write callback and makes it process response bytes using the application-provided write-data pointer.