CVE-2026-3805

A flaw was found in curl. When handling a second Server Message Block (SMB) request to the same host, curl incorrectly accesses memory that has already been freed. This memory corruption vulnerability, known as a use-after-free, could allow a remote attacker to potentially execute arbitrary code or cause a denial of service.

This Moderate flaw in curl's handling of Server Message Block (SMB) connections can lead to a use-after-free vulnerability. When a second SMB request is made to the same host, curl may incorrectly access previously freed memory, potentially resulting in arbitrary code execution or a denial of service. However, successful exploitation is considered difficult due to the specific conditions required to trigger the flaw reliably.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid using curl for Server Message Block (SMB) transfers. This can be achieved by ensuring that applications utilizing curl do not initiate SMB requests. If SMB transfers are essential, consider isolating the affected systems or restricting network access to SMB services. A service restart or reload may be required for changes to take effect.