The flaw occurs when libcurl’s multi interface pools TLS connections that outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches a library context to an easy handle’s state and passes it to OpenSSL without incrementing the reference count. Destroying the easy handle too early frees that context while the connection still holds a dangling pointer, producing a heap‐use‑after‑free during later I/O or post‑handshake stages. This memory corruption can potentially be leveraged to inject arbitrary code or to cause an application crash, leading to compromise or denial of service.

The vulnerability affects the curl library, which is embedded in a wide range of clients and servers that use libcurl’s multi interface to handle concurrent network operations. Any deployment that links against OpenSSL 3 and employs libcurl’s connection pooling is susceptible. Exact affected release numbers are not specified, so any version prior to the patch that includes the fix should be considered at risk.

The EPSS score indicates a very low exploitation probability (<1%), and the CVE is not listed in the KEV catalog, but the CVSS score of 7.5 indicates a high severity. Attackers would need to supply or control a TLS session that triggers the dangling context; therefore, the attack vector is inferred to rely on a malicious or compromised HTTPS endpoint that a client communicates with. Unfortunately no workaround is supplied, so the most effective mitigations are to update curl to a fixed version or otherwise prevent premature cleanup of easy handles during active multi connections.