CVE-2026-8925 -- CVSS 9.8 Vulnerability Briefing
CVE-2026-8925 | CVSS 9.8 (Critical) | Exploit: No known exploit
What Is It
CVE-2026-8925 is a double-free memory corruption vulnerability in Haxx curl, specifically within the SASL authentication logic that handles GSASL context cleanup.
Technical Detail
The flaw occurs when curl's SASL authentication code path executes cleanup of a GSASL context object without nullifying the pointer after the first free operation, allowing the same pointer to be passed to free() a second time. An attacker capable of influencing the SASL authentication flow, such as through a malicious or misconfigured server, could trigger this double-free condition. Depending on heap layout and runtime conditions, successful exploitation could lead to arbitrary code execution or process crash, with a CVSS score of 9.8 reflecting the critical severity of potential impact.
Exploitation Status
No known exploit exists for this vulnerability at this time. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as no known exploit, meaning no public proof-of-concept or active exploitation has been confirmed as of July 10, 2026.
Who Is Targeting This
No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability.
What To Do
Apply the vendor-supplied patch from Haxx as soon as it becomes available, prioritizing systems where curl is used with SASL or GSASL-based authentication against untrusted or external servers. In environments where patching cannot be applied immediately, consider disabling SASL authentication mechanisms in curl configurations or restricting curl's use to trusted server endpoints as a temporary workaround. Monitor for anomalous process crashes or heap corruption signals in applications that invoke curl with SASL authentication. Given the critical CVSS score, treat this as a high-priority patch item even in the absence of confirmed active exploitation.