A flaw in curl allows a remote malicious FTP server to trigger a failure in wildcard listing operations. The failure causes curl to mis‑handle its internal callback handlers when the operation ends. This mis‑management can lead to immediate application crashes or unsafe memory access, resulting in denial of service or memory corruption across any application that incorporates curl and performs FTP wildcard operations.

All systems that embed the curl library and have not applied the latest update are affected. The vulnerability is present in every released version of curl prior to the fix referenced by CVE‑2026‑92388. It can impact any environment where curl is used to perform FTP transfers that enable wildcard matching.

The CVSS score of 6.5 indicates a medium to high severity. No EPSS score is published, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote, requiring a malicious FTP server to communicate with the vulnerable curl client over the network. An attacker with the ability to control the server can trigger the failure and cause the application to crash or corrupt memory. Because the vulnerability relies on a server‑initiated failure and incorrect internal state handling, it is considered moderately exploitable under normal conditions.