libsoup CVE-2026-12478

Exploitation requires ALL of the following: (1) the target application uses libsoup for WebSocket client connectivity; (2) the application sets max_incoming_payload_size to exactly 0 - this is an explicit developer choice, not the default behavior, as 0 signals 'no limit'; (3) the client connects to a server under attacker control, or the connection is subject to a man-in-the-middle attack enabling frame injection. Limiting factors: applications using a non-zero max_incoming_payload_size are not exploitable via this path; server-side libsoup deployments are unaffected since the overflow concerns client-side frame reception; and libsoup versions not incorporating the CVE-2026-0716 patch (commit 6ff7ef0) carry a different overflow condition rather than this specific regression.

The CVSS 3.1 base score of 4.8 (Medium) is consistent with the realistic threat model. AV:N reflects that exploitation is remote - the attack originates from a WebSocket server the client connects to - but AC:H correctly captures that two compounding preconditions must align: the target application must have max_incoming_payload_size explicitly set to 0, and the attacker must control or compromise the server endpoint the client trusts. PR:N is accurate because from the attacker's perspective (operating the server), no credentials are needed. EPSS data was not provided in the input. No CISA KEV listing and no confirmed POC exist, making this a watch-and-patch item rather than an emergency. The dual impact - C:L (potential memory disclosure via OOB read) and A:L (potential crash) - is modest. The primary real-world risk is targeted exploitation against known applications that set max_incoming_payload_size=0, which is a non-default, intentional configuration. The regression nature of this flaw (introduced by an incomplete patch) increases confidence that a precise, weaponizable trigger exists, but no exploit has been publicly released.

An attacker operating or compromising a WebSocket server sends a crafted unmasked frame with a payload-length field set to a value near UINT64_MAX. A libsoup-based client application configured with max_incoming_payload_size=0 processes this frame, bypasses the integer overflow guard (which only runs on the masked path), and performs arithmetic that wraps around, directing reads into out-of-bounds memory - potentially leaking heap contents or crashing the client process. No public POC has been confirmed, but the regression is mechanically precise and a proof of concept would be straightforward for a researcher familiar with the original CVE-2026-0716 patch.