curl SMB Connection-Reuse Use-After-Free (CVE-2026-3805)

Metadata

Affected Target

Summary

libcurl’s SMB protocol handler stores a request-scoped req->path pointer that points into memory owned by a temporary “needle” connection object used during connection-cache lookup (smbc->share). When a second SMB transfer to the same server reuses an existing cached connection, the needle — and the smbc->share buffer it owns — is destroyed, but the surviving easy handle’s req->path still points at that now-freed heap region. The subsequent smb_send_open() call runs strlen() and copies the dangling pointer’s contents into the outgoing SMB OPEN packet, leaking heap memory to the server or crashing the process. The included script builds curl with AddressSanitizer and reproduces the use-after-free.

Vulnerability Details

Root Cause

req->path is set to a pointer inside the needle connection’s smbc->share buffer during smb_parse_url_path(); when the needle is freed on connection reuse (Curl_conn_free() → smb_conn_dtor()), req->path is left dangling on the surviving easy handle (CWE-416).

Attack Vector

1. Set up (or MITM) an SMB server that the target application connects to via libcurl.
2. Have the application issue two SMB requests to the same host with different share/file paths in the same session, allowing curl to reuse the underlying connection.
3. On the second request, smb_send_open() reads req->path via strlen() and copies the dangling heap contents into the SMB NT_CREATE_ANDX request sent to the (attacker-controlled) server.
4. Depending on heap state, the attacker-controlled server receives leaked process memory as the “filename,” or the client crashes.

Impact

Heap information disclosure to a malicious/MITM SMB server, or denial of service (crash) in applications embedding libcurl with SMB and NTLM support enabled.

Environment / Lab Setup

Target:   curl/libcurl 8.13.0 - 8.18.0 built with SMB + NTLM core support
Attacker: gcc/clang with AddressSanitizer, bash

Proof of Concept

PoC Script

See poc/REPRODUCE_UAF.sh in this folder.

1

./poc/REPRODUCE_UAF.sh

The script builds the affected curl version with -fsanitize=address, then issues two SMB requests to the same host with different shares/files (smb://server/share1/file1 then smb://server/share2/file2) so that connection reuse triggers the dangling req->path read, and AddressSanitizer reports the heap-use-after-free.

Detection & Indicators of Compromise

==PID==ERROR: AddressSanitizer: heap-use-after-free on address 0x...
READ of size 1 at 0x... thread T0
    #0 strlen
    #1 smb_send_open lib/smb.c:750

Signs of compromise:

• ASan/crash reports referencing smb_send_open / smb_conn_dtor in applications linking libcurl
• SMB servers receiving NT_CREATE_ANDX requests with garbage/non-printable “filenames”

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/Rat5ak/CVE-2026-3805-curl-SMB-UAF on 2026-07-05.