OSV-2025-657 Heap-use-after-free in ftp_pp_statemachine
A heap-use-after-free in the FTP state machine allows attackers to cause crashes or potentially execute code via malicious server responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is OSV-2025-657?
OSV-2025-657 is an use after free vulnerability in curl, published on 20 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=439473053
Crash type: Heap-use-after-free READ 8
Crash state:
ftp_pp_statemachine
ftp_doing
multi_runsingle
Which versions are affected by OSV-2025-657?
1 open source package ship an affected version, including curl.
| Package | Affected | Fixed in |
|---|---|---|
curl OSS-Fuzz | All versions | None |
How do I fix OSV-2025-657?
No fix has been published for OSV-2025-657 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is OSV-2025-657 being exploited?
There is no known exploitation of OSV-2025-657 in the wild and no public exploit code.