CVE-2026-85197

libsoup, the GNOME HTTP client library, contains a heap use-after-free (CWE-416) in its HTTP/2 client implementation, rated 7.6 High with a network attack vector and user interaction required. The flaw is triggered when an application uploads a file over HTTP/2 and the server - either a malicious endpoint or a man-in-the-middle attacker - sends a GOAWAY frame while the upload body is still being read asynchronously, causing connection state to be freed while still in use. Successful exploitation causes memory corruption that can lead to information disclosure or arbitrary code execution with the privileges of the affected application. Any application linked against a vulnerable libsoup that performs HTTP/2 uploads is affected, most notably GNOME desktop applications shipped by Linux distributions. There is no public proof-of-concept, no CISA KEV listing, and no known in-the-wild exploitation; EPSS estimates the 30-day exploitation probability at about 0.2% (12th percentile).

What to do: Apply the patched libsoup package from your distribution or vendor as soon as its security advisory referencing CVE-2026-85197 is published, since fixed version numbers are not provided in the available data. Until patched, avoid uploading files over HTTP/2 to untrusted servers and audit which installed GNOME/desktop applications link against libsoup and perform HTTP/2 uploads. No public workarounds or exploit code are documented yet.