A use‑after‑free flaw exists in libcurl's handling of HTTP/2 stream‑dependency configuration options (CURLOPT_STREAM_DEPENDS and CURLOPT_STREAM_DEPENDS_E). After an application configures a dependency tree and then calls curl_easy_reset(), the library frees internal structures prematurely. During the final cleanup call curl_easy_cleanup(), the freed memory is accessed and modified, potentially corrupting the process’s memory. This weakness is classified as CWE‑825, a use‑after‑free vulnerability. Based on the design, the corruption could allow an attacker to execute arbitrary code within the application that uses libcurl.

The issue affects libcurl implementations that expose the CURLOPT_STREAM_DEPENDS and CURLOPT_STREAM_DEPENDS_E options. Any application built against such a libcurl library—regardless of operating system—may be vulnerable if it resets an easy handle after setting a stream‑dependency tree and then cleans up the handle. All current public releases of libcurl with HTTP/2 stream‑dependency support are potentially impacted because no specific version ranges are listed.

The CVSS score of 9.8 indicates critical severity; the EPSS score below 1% suggests a low probability of real‑world exploitation at this time, and the vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector requires an attacker to influence the client’s configuration or trigger the reset/cleanup sequence, which is most plausibly a remote scenario where the client makes an HTTP/2 request with a deliberate stream‑dependency configuration. From the description, it is inferred that successful exploitation could grant remote code execution inside the client process, affecting confidentiality, integrity, and availability.