curl fixed CVE-2026-92392 in 8.23.0 on October 14 after a proof of concept showed a malicious HTTPS server could turn an HTTP/2 upload bug in curl and libcurl 8.12.0 through 8.22.0 into client-side code execution. The flaw sits in the uploader, not the server: the remote endpoint can trigger a use-after-free while receiving data, and the reporter demonstrated it on specific builds with about 135 KB uploaded over HTTP/2.
In plain terms, the server sends a stream-reset while curl is still managing upload state, freeing memory too early and then letting the client touch that memory again. That usually means a crash, but with the right build and memory layout it can become code execution on the machine doing the upload; the server certificate still has to pass validation, so trusted-looking endpoints can be the attacker.
Because libcurl is embedded in other applications, the exposure is bigger than the curl command line alone. Any software that inherits HTTP/2 upload behavior from libcurl can carry the same client-side risk until it moves to a fixed build, and patch status matters most anywhere outbound uploads go to third-party or attacker-controlled HTTPS services.