The vulnerability is a classic use‑after‑free condition in the curl library. According to the vendor description, during a second SMB request to the same host, curl incorrectly reuses a data pointer that references memory that has already been freed, leading to a use‑after‑free (CWE‑416). This memory corruption can allow an attacker to influence program behavior, potentially resulting in arbitrary code execution or denial of service by corrupting critical data structures.

The affected product is curl, listed under the haxx vendor (cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*). No specific version range is provided in the data, so any instance of curl that performs an SMB connection reuse could be susceptible. System administrators should consider all installations that use curl for SMB operations vulnerable until a patch is applied.

The CVSS score is 7.5, indicating a high severity, while the EPSS score is below 1 %, suggesting a low probability of widespread exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation would require an attacker to get a vulnerable curl instance to perform a second SMB request to the same host; the attack vector is remote, as the flaw occurs entirely within the client library during SMB communication.