Calling curl_easy_pause() within the event‑based CURLMOPT_SOCKETFUNCTION callback triggers a use‑after‑free (CWE‑825) vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer’s memory has been freed. This flaw can lead to unpredictable behavior or crashes, potentially causing a denial‑of‑service condition.

The vulnerability affects libcurl, the cross‑platform HTTP transfer library distributed by the curl vendor, as identified in the CNA registry (curl:curl). No specific version information is provided in the CVE record, so any installation of libcurl that contains the vulnerable code path is potentially impacted.

The CVSS score of 7.3 indicates high severity, yet the EPSS score of less than 1% suggests exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires that an application invoke curl_easy_pause() from within its socket callback, a scenario typically controlled internally. Based on the description, it is inferred that no publicly known exploits exist for this condition, and the potential damage is limited to heap corruption or denial of service rather than confirmed arbitrary code execution.