When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the… (CVE-2026-92388)

This vulnerability occurs when an FTP wildcard LIST operation fails in libcurl. The restoration path for successful listings is omitted, leaving the write callback set to the internal listing parser and its data pointing directly to the easy handle. Reusing the handle triggers crashes, and cloning it copies the corrupted state. Freeing the original handle and then using the clone causes heap use-after-free reads. Additionally, reusing either handle while changing only CURLOPT_WRITEDATA without resetting CURLOPT_WRITEFUNCTION causes type confusion, making the internal parser interpret server response bytes into application memory incorrectly.

The vulnerability can cause immediate application crashes, heap use-after-free memory reads, and type confusion leading to potential memory corruption. These issues arise from improper state restoration in libcurl's FTP wildcard LIST operation failure scenario. There is no indication of remote code execution or data disclosure in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid reusing or cloning libcurl easy handles after a failed FTP wildcard LIST operation. Carefully manage CURLOPT_WRITEDATA and CURLOPT_WRITEFUNCTION settings to prevent type confusion.