libsoup CVE-2026-12548

Exploitation requires that the victim application use libsoup to parse a multipart HTTP message originating from an attacker-controlled source. The triggering condition is specific: the integer type mismatch must manifest during the length calculation within soup_headers_parse() when processing multipart headers - this requires crafting headers that expose the signedness or width discrepancy between caller and callee. UI:R in the CVSS vector confirms that exploitation depends on a user or automated process actively causing the application to fetch and process the malicious multipart response; passive network positioning alone is insufficient. The AC:H metric further limits exploitation: attackers must meet precise conditions to cause the truncation reliably, ruling out trivial or spray-and-pray approaches. Exploitation is NOT limited by authentication on the attacker's side (PR:N), but IS limited to environments where libsoup-based applications process multipart content from untrusted or attacker-reachable HTTP endpoints.

The CVSS 3.1 base score of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L) accurately reflects a constrained threat. The High Complexity metric indicates exploitation requires specific, non-trivial conditions - the integer truncation must be triggered by carefully constructed multipart message headers. The UI:R requirement means a user or application must actively process a malicious multipart HTTP response from an attacker-controlled server. Combined, these factors substantially reduce the practical attacker success rate compared to simple network-triggerable bugs. The impact is limited: low confidentiality impact (partial heap disclosure) and low availability impact (application crash), with no integrity impact. No EPSS data was provided in the input, and neither KEV status nor public POC code has been identified, meaning no public exploit identified at time of analysis. Real-world risk is moderate - applications that parse multipart content from untrusted sources (e.g., web browsers built on libsoup, or GNOME apps fetching remote content) face the greatest exposure, while server-side or internal-only deployments are far less exposed.

An attacker hosts a malicious HTTP server that returns a crafted multipart HTTP response with headers engineered to trigger the integer type mismatch in soup_headers_parse(). When a victim user or application built on libsoup fetches content from this server - for example, through a GNOME application, a web browser using libsoup, or an application fetching a remote resource - the malformed length value causes the parser to read beyond the heap buffer, potentially crashing the application or leaking heap memory to the attacker. No public proof-of-concept code has been identified at time of analysis, and the AC:H rating indicates precise header construction is required to reliably trigger the truncation.