CVE-2026-92388

Name	CVE-2026-92388
Description	When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
curl (PTS)	bookworm	7.88.1-10+deb12u15	vulnerable
	bookworm (security)	7.88.1-10+deb12u5	vulnerable
	trixie	8.14.1-2+deb13u5	vulnerable
	trixie (security)	8.14.1-2+deb13u7	vulnerable
	forky	8.22.0-1	vulnerable
	sid	8.23.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
curl	source	(unstable)	8.23.0~rc1-1

Notes

[trixie] - curl <no-dsa> (Minor issue)
[bookworm] - curl <postponed> (Minor issue; can be fixed with next release)
https://curl.se/docs/CVE-2026-92388.html
Introduced with: https://github.com/curl/curl/commit/0825cd80a62c21725fb (curl-7_21_0)
Fixed by: https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212b90b35a93559163e (rc-8_23_0-1)
Fixed by: https://github.com/curl/curl/commit/b85acacec9b38442741bb019bc992e77b5f665d4 (rc-8_23_0-1)