CVE-2026-3805

high

Description

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.

References

https://github.com/Rat5ak/Rat5ak-Nadsec-2026-CVE-CERTIFIED-HOOD-CLASSICS

https://github.com/Rat5ak/CVE-2026-3805-curl-SMB-UAF

https://hackerone.com/reports/3591944

https://curl.se/docs/CVE-2026-3805.json

https://curl.se/docs/CVE-2026-3805.html

http://www.openwall.com/lists/oss-security/2026/03/11/4

Details

Source: Mitre, NVD

Published: 2026-03-11

Updated: 2026-03-12

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: High

EPSS

EPSS: 0.00018