CVE-2026-8925

criticalpriority · track · 0EPSS 0.011 · 65 %ileDEEUFRUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.08% (65th) EPSS

CVSS 9.8 · critical

Is it mine?

27 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · certfr

EPSS · scored 2026-10-27

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-415USprimary

affected products (27)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
IBM AIX 7.3all versionscert_bundDEcpe:/o:ibm:aix:7.3
IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
IBM MQ Operatorall versionscert_bundDEcpe:/a:ibm:mq:operator
Microsoft Azure Linux azl3all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat JBoss Core Servicesall versionscert_bundDEcpe:/a:redhat:jboss_core_services:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Dell Secure Connect Gateway< 5.36.00.16cert_bundDE
Meinberg LANTIME< V7.10.013cert_bundDE
Open Source cURL< 8.21.0cert_bundDE
Splunk Splunk Enterprise< 10.0.10cert_bundDE
Splunk Splunk Enterprise< 10.2.7cert_bundDE
Splunk Splunk Enterprise< 10.4.3cert_bundDE
Splunk Splunk Enterprise< 9.4.15cert_bundDE

showing 20 of 27

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2065cURL: Mehrere SchwachstellenDeutsch2026-06-24csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
CERTFR-2026-AVI-1390Multiples vulnérabilités dans Tenable Network MonitorFrançais2026-10-27vendor · certfrFR
CURL-CVE-2026-8925SASL double-free2026-06-24vendor · osvUS
The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund certfr osv NVD CVE.org MITRE

published 2026-07-03modified 2026-07-07

related (1,208)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-33824US	—OT critical	77.1% (100th)	KEV	2026-04-14
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
CVE-2025-62215US	—OT critical	4.46% (91st)	KEV	2025-11-11
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2021-22600US	high7.0OT critical	6.59% (94th)	KEV	2022-01-26
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgr…
CVE-2021-26411US	medium5.1OT critical	81.7% (100th)	KEV	2021-03-11
Internet Explorer Memory Corruption Vulnerability
CVE-2020-9859US	high7.8OT critical	0.83% (57th)	KEV	2020-06-05
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6…

+1203 more

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan