CVE-2026-92388— FTP wildcard write callback mixup
Quick assessment
Affected
curl curl
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当 FTP 通配符 操作失败时，libcurl 会遗漏本应在成功列表操作中执行的目录路径恢复步骤，导致写入回调函数仍被设置为内部列表解析器，而写入回调数据则直接指向 easy handle（易处理句柄）。此后若再次复用该句柄，将立即引发程序崩溃；若通过 克隆该句柄，则会将此损坏状态复制到副本中。若随后释放原始句柄，在克隆句柄上执行传输操作时，将对悬空的句柄引用造成堆内存释放后读取（heap use-after-free read）漏洞；或者，在仅更改 （且未设置 ）的情况下复用原始或克隆句柄，会导致类型混淆（typ
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1055 · Process Injection T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92388
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FTP wildcard write callback mixup
Source: CVE Program / CVE List V5
Vulnerability Description
When an FTP wildcard `LIST` operation fails, libcurl omits the restoration
path meant for successful listings, leaving the write callback set to the
internal listing parser and the write callback data pointing directly to the
easy handle. Subsequent reuse of this handle triggers an immediate crash, and
cloning it via `curl_easy_duphandle()` copies this corrupted state into the
duplicate. If the original handle is subsequently freed, executing a transfer
on the cloned handle causes a heap use-after-free read against the dangling
handle reference; alternatively, reusing the original or cloned handle while
changing only `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)
results in type confusion, forcing the internal parser to interpret incoming
server response bytes into memory at the application-supplied write data
pointer.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92388
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92388
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92388 (1)
Vendor Pages for CVE-2026-92388 (1)
Other References for CVE-2026-92388 (1)
Same Patch Batch · curl · 2026-10-20 · 23 CVEs total
| CVE-2026-92391 | curl_mime_free stack overflow by recursion | |
| CVE-2026-107928 | info leak uploading over WebSockets with GnuTLS | |
| CVE-2026-107929 | local interface connection reuse mixup | |
| CVE-2026-94266 | password leak in CURLINFO_EFFECTIVE_URL | |
| CVE-2026-94265 | Authorization: Negotiate sent to foreign origin | |
| CVE-2026-86415 | auto client cert connection reuse mixup | |
| CVE-2026-86414 | leaking host credentials to HTTP proxy | |
| CVE-2026-92390 | -J no-clobber guarantee bypassed with 103 early hints | |
| CVE-2026-92387 | never-ending loop via server response omission | |
| CVE-2026-92386 | server-set cookie aborts cookie jar load | |
| CVE-2026-92389 | TFTP direction confusion | |
| CVE-2026-86409 | stale SigV4 headers sent unintended | |
| CVE-2026-87865 | knownhost callback mismatches key as missing | |
| CVE-2026-87864 | IMAP APPEND plus CRLF conversion command injection | |
| CVE-2026-87863 | HSTS response erases persisted entries | |
| CVE-2026-87866 | wolfSSL public-key pinning bypass | |
| CVE-2026-87861 | cross-origin reuse of a Negotiate connection | |
| CVE-2026-87862 | HSTS cache import drops longer-lived child | |
| CVE-2026-86411 | FTP connection reuse inherits client-certificate | |
| CVE-2026-86412 | server-set cookie erases cookie jar |
Showing top 20 of 23 CVEs. View all on vendor page → →