Libcurl’s SMB connection reuse logic contains a logical error that can cause a transfer to occur on an unintended share. As a result, a download may pull the wrong file or an upload may place a file in an incorrect location while using the same credentials and server name. This flaw, identified as CWE‑1025 and CWE‑918, undermines data integrity by enabling accidental or malicious leakage or corruption of data.

The cURL client, which incorporates libcurl, is specifically mentioned as an affected vendor/product. Because libcurl is a widely used library, any application that relies on cURL to perform SMB transfers could also be affected, provided it uses SMB functionality. The precise version range is not listed, so any libcurl installation that has not received the fix may be vulnerable.

The CVSS score of 7.5 classifies the issue as high severity, while the EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not included in the CISA KEV catalog. An attacker would need to influence the SMB transfer parameters set by the vendor application, for example by supplying crafted requests or modifying local configuration, to trigger a cross‑share data transfer.