CVE-2026-12548 Libsoup: heap out-of-bounds read in libsoup due to integer truncation
A remote attacker can crash applications or read heap memory via an integer truncation flaw in libsoup's multipart HTTP parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-12548?
CVE-2026-12548 is a medium-severity memory corruption vulnerability in Redhat Enterprise Linux, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.
Weakness: CWE-125
Which versions are affected by CVE-2026-12548?
It affects 2 products.
Linux distribution packages (7)
libsoup SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 3.4.4-150600.3.50.1 |
libsoup2 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.74.3-150600.4.39.1 |
libsoup2 SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 2.74.3-150600.4.39.1 |
libsoup SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.62.2-5.46.1 |
libsoup2 SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 2.74.3-150600.4.39.1 |
libsoup openSUSE:Tumbleweed | All versions | 3.6.6-8.1 |
libsoup2 openSUSE:Tumbleweed | All versions | 2.74.3-22.1 |
Products include Gnome Libsoup, Redhat Enterprise Linux.
How do I fix CVE-2026-12548?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-12548 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12548 exists.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-102556 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
- CVE-2026-102557 Libsoup: libsoup: heap buffer overflow during websocket message reassembly
- CVE-2026-102558 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
- CVE-2026-102559 Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
- CVE-2026-102560 Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
Sources
Also known as CLSA-2026-1788856994, CLSA-2026-1788859279, DEBIAN-CVE-2026-12548, ECHO-b6fb-3d23-a17e, GHSA-wmh6-vpqv-v8q3, SUSE-SU-2026:3973-1 and 5 more.