CVE-2025-32914 Memory corruption in Red Hat Enterprise Linux 10
A malicious HTTP client can trigger an out-of-bounds read in libsoup, causing a crash or process exit, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32914?
CVE-2025-32914 is a high-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 14 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.
Weakness: CWE-125
Which versions are affected by CVE-2025-32914?
How do I fix CVE-2025-32914?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-32914 being exploited?
There is no known exploitation of CVE-2025-32914 in the wild and no public exploit code.
Sources
Also known as AZL-60378, AZL-60422, DEBIAN-CVE-2025-32914, GHSA-89g2-jrcc-p8r7, ROOT-OS-DEBIAN-12-CVE-2025-32914, UBUNTU-CVE-2025-32914.