A UAF turned RCE
curl 8.23.0 fixes CVE-2026-92392, a high-severity HTTP/2 use-after-free that can lead to RCE.
curl 8.23.0 fixes CVE-2026-92392, rated HIGH, an HTTP/2 upload use-after-free in libcurl. After a server pauses an upload, returns part of a response, and resets the stream, curl can retain a pointer to a freed easy handle; later multi-handle cleanup may write server-controlled data into that memory and invoke a modified function pointer, enabling remote code execution. The project says many conditions must align, including a valid certificate, an upload near 135KB, architecture-specific payloads, and allocator behavior, so a crash is the likely outcome and in-the-wild success is considered slim. It was reported by Luna Tong at Anthropic using the OSS Scanner.