Integer Overflow Vulnerability in libsoup Affecting Red Hat Products
CVE-2026-12478

4.8MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10
Vendor: CVE Published:; 14 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-12478?

This vulnerability arises due to the improper placement of an integer overflow guard in libsoup, specifically within the conditional block for masked frames. As a result, unmasked server-to-client frames are vulnerable. A malicious WebSocket server could exploit this flaw by sending a specially crafted unmasked frame with a payload length close to UINT64_MAX. If the max_incoming_payload_size parameter is set to 0, it may lead to an out-of-bounds read in the libsoup-based client, potentially compromising user data and application behavior.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

security-research
Created by Popy21