CVE-2026-92388 FTP wildcard write callback mixup
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-92388?
CVE-2026-92388 is a vulnerability in curl, published on 20 Oct 2026.
Official description
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash, and cloning it via `curl_easy_duphandle()` copies this corrupted state into the duplicate. If the original handle is subsequently freed, executing a transfer on the cloned handle causes a heap use-after-free read against the dangling handle reference; alternatively, reusing the original or cloned handle while changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`) results in type confusion, forcing the internal parser to interpret incoming server response bytes into memory at the application-supplied write data pointer.
Which versions are affected by CVE-2026-92388?
How do I fix CVE-2026-92388?
Upgrade to a fixed version.
Is CVE-2026-92388 being exploited?
There is no known exploitation of CVE-2026-92388 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-92388, AZL-109917, AZL-109944, AZL-110004, AZL-110163, AZL-110217 and 8 more.