Executive Summary

CVE-2026-3805 is a use-after-free vulnerability in curl that occurs during SMB connection reuse. Specifically, when curl makes a second SMB request to the same host, it incorrectly uses a data pointer that points to memory that has already been freed.

This causes curl to perform a strlen() operation on this freed memory pointer and then check if the string length is less than or equal to 1024 before copying the string into the outgoing package.

Because the memory has been freed, it may have been overwritten by other application data, potentially leading to leakage of sensitive information.

The vulnerability affects curl versions 8.13.0 through 8.18.0 and was fixed in version 8.19.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can potentially lead to leakage of sensitive data if the freed memory was overwritten by application data since the previous transfer.

However, exploitation is considered extremely difficult because it is unlikely that applications would execute the exact sequence of operations without crashing or encountering other issues.

Therefore, the overall risk posed by this vulnerability is minimal.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

There are no specific detection commands or network/system detection methods provided for this vulnerability in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-3805 vulnerability, it is recommended to upgrade curl and libcurl to version 8.19.0 or later, where the issue has been fixed.

Alternatively, apply the patch provided for this vulnerability and rebuild libcurl.

If upgrading or patching is not immediately possible, avoid using SMB transfers with curl to prevent triggering the vulnerability.

Useful 0 Not Useful 0