A UAF TURNED RCE

Summary from the TLDR InfoSec newsletter

curl 8.23.0 patched CVE-2026-92392, a HIGH-severity HTTP/2 upload use-after-free that allowed a malicious server to achieve remote code execution when a reset on a paused stream left libcurl holding a dangling pointer to a freed easy handle. During multi-handle cleanup, server data overwrote that freed memory, including a function pointer, while a leaked request exposed local addresses to defeat ASLR. Anthropic's OSS Scanner found the bug, which maintainers rated below CRITICAL because exploitation requires a ~135KB upload and depends on allocation patterns that vary across distros and libc versions.