cyfenced.com →

[ CVE-2026-102555 · Published 29 Sep 2026 ]

Vulnerability in Red Hat Enterprise Linux 10

CVSS 8.2 EPSS <1%No fix listed yet

[ Description ]Official description

A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References