Public vulnerability disclosure
CVE-2026-102555
Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding
publishedCWE-125
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
Technical severity8.2 highCVSS 3.1 · CNA: redhat
Published2026-09-29Source updated 2026-11-02
Collected2026-11-022 attributed sources
Fixes and workarounds
Workaround
To mitigate this do not pass untrusted data URIs to soup_uri_decode_data_uri().
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat Enterprise Linux 10 Red Hat libsoup3
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.6.5-3.el10_2.20; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat libsoup3
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:3.6.5-3.el10_0.19; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 6 Red Hat libsoup
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unknown |
CNA: redhat |
| Red Hat Enterprise Linux 7 Red Hat libsoup
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Enterprise Linux 8 Red Hat libsoup
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Enterprise Linux 9 Red Hat libsoup
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 8.2 high |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H | CNA: redhat |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/errata/RHSA-2026:83618CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:93583CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-102555CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2543224CNA: redhat · issue-tracking, x_refsource_REDHAT