Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-92388 Overview
CVE-2026-92388 affects libcurl's handling of failed FTP wildcard LIST operations. When the listing fails, libcurl skips the cleanup path that normally restores the application-supplied write callback and write data pointer. The internal listing parser remains installed as the write callback, and the write data pointer continues to reference the easy handle itself.
Reusing the affected handle crashes immediately. Cloning the handle with curl_easy_duphandle() propagates the corrupted state to the duplicate. Freeing the original then transferring on the clone produces a heap use-after-free read. Alternatively, changing only CURLOPT_WRITEDATA without resetting CURLOPT_WRITEFUNCTION causes type confusion that writes server bytes to the application-supplied pointer.
Critical Impact
Attackers who influence FTP server responses can trigger memory corruption, process crashes, or controlled writes against application memory in programs reusing libcurl easy handles after a failed FTP wildcard listing.
Affected Products
- libcurl (FTP wildcard LIST code path)
- Applications linking libcurl that use CURLOPT_WILDCARDMATCH with FTP
- Downstream distributions and language bindings embedding the vulnerable libcurl build
Discovery Timeline
- 2026-10-20 - CVE-2026-92388 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-92388
Vulnerability Analysis
The flaw sits in libcurl's FTP wildcard matching feature. When an application enables CURLOPT_WILDCARDMATCH, libcurl temporarily swaps the user's write callback and write data pointer for an internal listing parser. The parser consumes LIST output and feeds matched filenames back through the application callback.
On the success path, libcurl restores the original CURLOPT_WRITEFUNCTION and CURLOPT_WRITEDATA. On the failure path, the restoration step is skipped. The easy handle is left with its write callback pointing at the internal listing parser and its write data field aliased to the easy handle structure itself.
Root Cause
The root cause is missing cleanup on an error branch combined with type confusion between the internal parser's expected context and arbitrary application pointers. The write callback and its data pointer are not treated as atomic state, so partial restoration is possible when LIST fails.
Attack Vector
A malicious or compromised FTP server can force the LIST operation to fail after libcurl has installed the internal parser. The application then holds a handle in a corrupted state. Three outcomes follow depending on how the application reuses the handle.
Reusing the handle directly dereferences the stale parser context and crashes. Duplicating with curl_easy_duphandle() and freeing the original yields a use-after-free when the clone performs a transfer. Setting only CURLOPT_WRITEDATA without also setting CURLOPT_WRITEFUNCTION causes the parser to interpret inbound server bytes as its own structure and write into the attacker-chosen pointer.
No verified exploit code is published. Technical details are documented in the curl Security Advisory CVE-2026-92388 and the HackerOne Report #4022070.
Detection Methods for CVE-2026-92388
Indicators of Compromise
- Application crashes or segmentation faults in processes using libcurl shortly after FTP transfers that use CURLOPT_WILDCARDMATCH.
- Unexpected FTP LIST failures from servers followed by abnormal process behavior or memory writes to application buffers.
- Core dumps showing faulting addresses inside libcurl's FTP wildcard listing parser functions.
Detection Strategies
- Audit source code for use of CURLOPT_WILDCARDMATCH combined with handle reuse through curl_easy_reset() or curl_easy_duphandle().
- Run fuzzing or targeted integration tests that force FTP LIST to fail and then exercise the same easy handle.
- Enable AddressSanitizer in test builds to surface the use-after-free read on cloned handles.
Monitoring Recommendations
- Collect and triage crash telemetry from applications that perform FTP wildcard listings against untrusted servers.
- Monitor outbound FTP connections and flag unusual destinations for processes using libcurl.
- Alert on repeated libcurl crashes correlated with FTP sessions in endpoint and workload logs.
How to Mitigate CVE-2026-92388
Immediate Actions Required
- Inventory applications and container images that link libcurl and identify those using FTP wildcard matching.
- Upgrade libcurl to the fixed release identified in the curl Security Advisory CVE-2026-92388.
- Restrict FTP transfers to trusted servers until the patched libcurl is deployed everywhere.
Patch Information
The curl project publishes patch metadata in the curl JSON Advisory CVE-2026-92388. Rebuild statically linked binaries against the patched libcurl and redeploy container images that bundle the library.
Workarounds
- Disable CURLOPT_WILDCARDMATCH and perform directory listing and filename matching in application code.
- Avoid reusing or duplicating easy handles after any FTP wildcard transfer error; call curl_easy_cleanup() and create a fresh handle instead.
- When reconfiguring a handle, always set both CURLOPT_WRITEFUNCTION and CURLOPT_WRITEDATA together, never one in isolation.
# Verify installed libcurl version and FTP feature support
curl --version
ldconfig -p | grep libcurl
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
