EUVD-2026-89102
GHSA-vfxx-hcqj-vrh4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Untrusted data URIs are reachable over the network without auth (AV:N/PR:N/UI:N); OOB read yields limited memory disclosure (C:L) and reliable crash (A:H) with no integrity impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
Articles & Coverage 1
AnalysisAI
Out-of-bounds read and application crash in libsoup's soup_uri_decode_data_uri() affect applications that pass attacker-controlled base64 data: URIs to the GLib-based HTTP library, with Red Hat shipping vulnerable packages across Red Hat Enterprise Linux 6, 7, 8, 9 and 10. A crafted data URI whose percent-decoded payload contains embedded NUL bytes causes the decoded length to remain uninitialized and be used as the size of the returned GBytes, yielding a minor confidentiality leak (C:L) alongside a serious availability impact (A:H) rated 8.2 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application invoke libsoup's soup_uri_decode_data_uri() on an attacker-supplied base64 data: URI whose percent-decoded payload contains embedded NUL bytes; the crafted NUL causes the decoded length to remain uninitialized and be used as the GBytes size. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) is driven mostly by the availability impact (A:H, application crash) with a minor confidentiality leak (C:L) from the out-of-bounds read; there is no integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status could not be confirmed from the available data: no fixed libsoup version is specified in the provided references, so administrators should track the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-102555 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2543224 for the exact errata and update libsoup (and every application linked against it, which may require rebuilding dependent WebKit/GNOME packages) as soon as a vendor build is released. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Red Hat Enterprise Linux 6, 7, 8, 9, and 10 for libsoup packages and identify applications that process untrusted data: URIs (e.g., WebKitGTK browsers, Evolution, GNOME feed readers); immediately restrict or disable remote content rendering and data: URI handling in those applications where configuration allows. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today