CVE-2026-12478 Overview
CVE-2026-12478 is an out-of-bounds read vulnerability in libsoup, the GNOME HTTP client/server library. The flaw exists in the WebSocket frame handling code and stems from an incomplete fix for the earlier CVE-2026-0716. In commit 6ff7ef0 (libsoup 3.6.6), the integer overflow guard was placed inside the if (masked) branch, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame declaring a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0. This affects any GNOME or GTK application that consumes WebSocket data through libsoup.
Critical Impact
A malicious WebSocket server can trigger out-of-bounds memory reads in vulnerable client applications, leading to information disclosure or client-side crashes.
Affected Products
- GNOME libsoup versions incorporating the incomplete fix from commit 6ff7ef0 (libsoup 3.6.6 and related builds)
- Client applications using libsoup WebSocket APIs with max_incoming_payload_size set to 0
- Linux distributions shipping the affected libsoup builds (see Red Hat advisory for distribution-specific packages)
Discovery Timeline
- 2026-07-14 - CVE-2026-12478 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-12478
Vulnerability Analysis
The vulnerability is classified under [CWE-125] Out-of-Bounds Read. It resides in the WebSocket frame parser inside libsoup. The library previously received a fix for CVE-2026-0716 to prevent integer overflow when computing frame buffer sizes. That fix positioned the overflow guard inside the branch that handles masked frames only.
WebSocket protocol semantics require client-to-server frames to be masked, while server-to-client frames are transmitted unmasked. Because the overflow check applied only to the masked branch, unmasked frames delivered by a server bypassed the size validation entirely. When a client sets max_incoming_payload_size to 0, the default upper bound on frame size is disabled, allowing the declared payload length to be treated as an untrusted 64-bit value.
The result is an out-of-bounds read when the frame processing code attempts to access memory based on the attacker-controlled length field.
Root Cause
The root cause is a scoping error in the patch for CVE-2026-0716. The integer overflow guard was placed inside an if (masked) conditional block rather than at a location that covers both masked and unmasked frame paths. This left server-to-client frame parsing without any protection against a payload length approaching UINT64_MAX.
Attack Vector
Exploitation requires a victim to establish a WebSocket connection from a libsoup-based client to an attacker-controlled server. The attacker responds with a crafted unmasked frame whose declared payload length is near UINT64_MAX. When the client parses this frame with max_incoming_payload_size set to 0, the length is not validated, and subsequent read operations reference memory outside the intended buffer. The attack is remote and requires no authentication, but requires the victim to initiate the WebSocket handshake, which raises attack complexity.
No verified public exploit code is available. See the GNOME Merge Request #518 for the corrected patch and the Red Hat CVE-2026-12478 Advisory for additional technical context.
Detection Methods for CVE-2026-12478
Indicators of Compromise
- Unexpected crashes or segmentation faults in GNOME or GTK applications immediately after a WebSocket connection to an external host
- Outbound WebSocket handshakes to untrusted or newly registered domains from user workstations
- WebSocket frames with declared payload lengths approaching UINT64_MAX captured in network traffic
Detection Strategies
- Inspect installed libsoup package versions against the fixed versions listed in the Red Hat CVE-2026-12478 Advisory
- Monitor process telemetry for repeated crashes of libsoup-linked applications correlated with outbound TCP traffic on WebSocket ports
- Deploy network detections that flag WebSocket frames with anomalous 64-bit extended payload length fields
Monitoring Recommendations
- Aggregate application crash telemetry and correlate with outbound network sessions to identify potential exploitation attempts
- Alert on WebSocket upgrade requests from desktop workloads to domains outside your organizational allowlist
- Track deployment status of the patched libsoup package across the Linux estate using configuration management data
How to Mitigate CVE-2026-12478
Immediate Actions Required
- Apply the updated libsoup package from your Linux distribution once the corrected patch from GNOME Merge Request #518 is available in vendor repositories
- Audit applications that call soup_websocket_* APIs and confirm whether they set max_incoming_payload_size to 0
- Restrict outbound WebSocket connectivity from workstations to trusted destinations where feasible
Patch Information
The fix corrects the scoping error introduced in commit 6ff7ef0 by moving the integer overflow guard outside the if (masked) block so that both masked and unmasked frames are validated. Refer to the Red Hat CVE-2026-12478 Advisory, the Red Hat CVE-2026-0716 Advisory, and the Red Hat Bug Report #2489655 for distribution-specific package versions.
Workarounds
- Set max_incoming_payload_size to a bounded value (the library default) instead of 0 in application code that uses libsoup WebSocket clients
- Block or proxy outbound WebSocket traffic through a gateway that enforces frame size limits
- Limit exposure by disabling WebSocket features in applications where the functionality is not required until patched packages are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
