libsoup vulnerabilities in Ubuntu
Two vulnerabilities in libsoup on Ubuntu 22.04, 24.04, 26.04 and 26.10 could let remote attackers cause crashes or expose sensitive information (CVE-2026-12478, CVE-2026-102555).
40
CVE-2026-102555
Out-of-bounds read in libsoup data-URI decoding
- CVSS 3.1
- 8.2 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A flaw in libsoup's soup_uri_decode_data_uri() mishandles base64 data-URI payloads that contain embedded NUL bytes after percent-decoding. The function treats the payload as a NUL-terminated string for g_base64_decode_inplace(), so the decoded length can stay uninitialized and then be used as the size of the returned GBytes. A remote attacker who can supply a crafted data URI, with no privileges and no user interaction, can cause an out-of-bounds read (CWE-125) or crash the application; confidentiality impact is limited and integrity is not affected. Typical users are Linux desktops and services that link libsoup, including GNOME and WebKitGTK-based software; the advisory does not name a version range. There is no known public proof-of-concept and the issue is not listed in CISA KEV.
What to do: Install the libsoup update shipped by your Linux distribution or vendor as soon as it is available, and restart processes that link against libsoup so they load the fixed library. Until then, limit applications that pass untrusted data URIs into libsoup, and watch those processes for crashes when handling data: URIs. No fixed version range is named in the advisory data, so match the package against your vendor's CVE-2026-102555 erratum rather than guessing a version.
| Product | Affected |
|---|---|
| GNOME libsoup | — |
Estimated exposure
massMillions of Linux systems ship libsoup; how many process untrusted data URIs is unknown — libsoup is a standard HTTP client library in the GNOME and WebKitGTK stacks and is packaged by major Linux distributions, so installed copies are on the order of many millions of desktops and servers; the count of processes that actually…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
- Products
- libsoup, enterprise linux
- Weakness
- CWE-125
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H