CVE-2025-32913 Null dereference in Red Hat Enterprise Linux 10
A malicious HTTP peer can crash applications using libsoup by sending a malformed Content-Disposition header, causing a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32913?
CVE-2025-32913 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 14 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function.
Weakness: CWE-476
Which versions are affected by CVE-2025-32913?
How do I fix CVE-2025-32913?
Apply the vendor's patch.
Is CVE-2025-32913 being exploited?
There is no known exploitation of CVE-2025-32913 in the wild and no public exploit code.
Sources
Also known as AZL-60389, AZL-60402, DEBIAN-CVE-2025-32913, GHSA-9589-mpwg-8xq6, ROOT-OS-DEBIAN-12-CVE-2025-32913, UBUNTU-CVE-2025-32913.