CVE Watch7 jul 2026

CVE-2026-9080

Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl

CVSS

7.3

Alto

EPSS

0.3%

p22

KEV

—

Exploit Today

0-100

Publicado: 3 jul 2026 · Última mod.: 7 jul 2026 · CWE-416

EPSS · 30d

0.3%EPSS · 30 días0.5%

2026-08-112026-09-07

Descripción técnica

Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-853607.0 ALT

—

———Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.6h CVE-2026-839978.1 ALT

—

———Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.6h CVE-2026-839797.8 ALT

—

———Use after free in Windows Biometric Service allows an authorized attacker to elevate privileges locally.6h CVE-2026-839687.8 ALT

—

———Use after free in Windows Biometric Service allows an authorized attacker to elevate privileges locally.6h CVE-2026-839407.0 ALT

—

———Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.6h CVE-2026-819547.8 ALT

—

———Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.6h