CVE-2026-102555: libsoup Buffer Overflow Vulnerability

CVE-2026-102555 Overview

CVE-2026-102555 is an out-of-bounds read vulnerability in libsoup, the HTTP client/server library used by GNOME and numerous Linux applications. The flaw resides in the soup_uri_decode_data_uri() function, which incorrectly treats base64 data-URI payloads as NUL-terminated strings when invoking g_base64_decode_inplace(). When a percent-decoded payload contains embedded NUL bytes, the decoded length variable can remain uninitialized and is subsequently used as the size of the returned GBytes object. Processing a crafted data: URI triggers out-of-bounds memory access or an application crash. The issue is tracked under [CWE-125: Out-of-bounds Read].

Critical Impact
Remote attackers can crash applications parsing untrusted data: URIs and potentially read adjacent process memory, exposing sensitive data handled by libsoup consumers.

Affected Products

libsoup (HTTP client/server library)
Applications and desktop environments consuming libsoup for URI handling (see Red Hat advisory for distribution package mapping)
GNOME components that process data: URIs via libsoup

Discovery Timeline

2026-09-29 - CVE-2026-102555 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102555

Vulnerability Analysis

The vulnerability lives inside soup_uri_decode_data_uri(), which parses data: URIs and returns the decoded payload to callers as a GBytes buffer. For base64-encoded payloads, the function calls g_base64_decode_inplace(), an API that expects a length parameter passed by reference and writes the decoded byte count back to that variable.

libsoup passes the length derived from the percent-decoded string using string-length semantics. When the percent-decoded input contains embedded NUL bytes, the effective string length terminates prematurely and the length variable handed to g_base64_decode_inplace() is not properly populated for the full buffer. On error or edge conditions, that length variable can remain uninitialized. libsoup then uses this uninitialized value as the size of the returned GBytes.

Downstream consumers reading from the returned buffer perform an out-of-bounds read that either crashes the process or exposes adjacent heap memory to the calling application. This yields confidentiality loss and a reliable denial-of-service primitive against any process that renders untrusted data URIs.

Root Cause

The root cause is a mismatch between C string semantics and binary buffer semantics. soup_uri_decode_data_uri() treats a byte buffer that may contain NULs as if it were a NUL-terminated string, and it fails to initialize the length output variable before use. This is a classic uninitialized-memory-plus-out-of-bounds-read pattern under [CWE-125].

Attack Vector

Exploitation requires no authentication and no user interaction beyond the target application consuming a crafted data: URI. Any network-reachable attack path that feeds a URI into libsoup, such as HTML content rendered by a WebKitGTK-based browser, an RSS reader, an email client, or a chat application, is a candidate. The attacker crafts a data: URI whose base64 payload, after percent-decoding, contains embedded NUL bytes to trigger the uninitialized length condition.

No public proof-of-concept or in-the-wild exploitation has been reported. Technical details are described in the Red Hat CVE-2026-102555 Advisory and Red Hat Bug Report #2543224.

Detection Methods for CVE-2026-102555

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libsoup-2.4 or libsoup-3.0 when handling web content or feed data
Application logs referencing soup_uri_decode_data_uri or g_base64_decode_inplace in crash traces
Anomalous data: URIs with unusually long base64 payloads containing percent-encoded %00 sequences observed in HTTP responses or cached content

Detection Strategies

Inventory installed libsoup packages across Linux endpoints and servers, comparing versions against fixed builds published by the distribution vendor
Enable core dump collection and crash telemetry on desktop endpoints to surface libsoup-related faults
Inspect web proxy and TLS-inspection logs for HTML or feed content containing suspiciously crafted data: URIs

Monitoring Recommendations

Forward application crash events and coredumps to a centralized logging pipeline for correlation and retention
Track patch state of libsoup packages continuously through vulnerability management tooling rather than one-time scans
Alert on repeated crashes of the same libsoup-consuming process on a single host, which can indicate targeted probing

How to Mitigate CVE-2026-102555

Immediate Actions Required

Apply the updated libsoup packages provided by your Linux distribution as soon as they are available
Restart or relaunch all long-running processes linked against libsoup so they load the patched shared library
Prioritize patching on user endpoints and application servers that process untrusted web, RSS, or email content

Patch Information

Refer to the Red Hat CVE-2026-102555 Advisory for authoritative package versions and errata. Downstream distributions rebuild libsoup on their own cadence, so consult the security tracker for Debian, Ubuntu, SUSE, or Fedora as applicable. The upstream fix ensures the length variable passed to g_base64_decode_inplace() is properly initialized and that the returned GBytes size reflects the actual decoded byte count rather than a string length.

Workarounds

Where feasible, disable or restrict processing of data: URIs in applications that expose libsoup to untrusted input
Use application sandboxing such as Flatpak, bubblewrap, or SELinux confinement to limit the impact of a crash or information disclosure
Deploy web content filtering to strip or normalize data: URIs from untrusted HTML before it reaches vulnerable clients

bash

# Verify installed libsoup version on RHEL/Fedora
rpm -qa | grep -i libsoup

# Verify installed libsoup version on Debian/Ubuntu
dpkg -l | grep -i libsoup

# Apply vendor updates
sudo dnf update libsoup libsoup3   # RHEL/Fedora
sudo apt update && sudo apt install --only-upgrade libsoup2.4-1 libsoup-3.0-0   # Debian/Ubuntu