When an FTP wildcard LIST command fails, libcurl mistakenly leaves the write callback pointing to its internal listing parser and sets the callback data to the easy handle itself. Reusing that handle then causes an immediate crash, while duplicating it copies this corrupted state into the duplicate handle. If the original handle is freed beforehand, performing another transfer with the cloned handle triggers a heap use‑after‑free read. Alternatively, changing only CURLOPT_WRITEDATA without setting CURLOPT_WRITEFUNCTION leads to type confusion, causing the internal parser to interpret server response bytes into memory at the application‑supplied write data pointer. A remote malicious FTP server can trigger the initial failure, so this flaw can result in application crashes and uncontrolled memory access, effectively denying service or corrupting memory in any program that uses libcurl for FTP wildcard operations.

All systems that embed the curl library and have not applied the latest update are affected. The vulnerability is present in every released version of curl prior to the fix referenced by CVE‑2026‑92388. It can impact any environment where curl is used to perform FTP transfers that enable wildcard matching.

The CVSS score of 9.1 indicates critical severity. An EPSS score of 0.00257 indicates a very low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote, requiring a malicious FTP server to communicate with the vulnerable curl client over the network. An attacker with control over the server can trigger the failure and cause the application to crash or corrupt memory. Because the vulnerability relies on a server‑initiated failure and incorrect internal state handling, it is considered moderately exploitable under normal conditions.