CVE-2026-102555
published 2026-09-29CVE-2026-102555: A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling…
PriorityP341high8.2CVSS 3.1
AVNACLPRNUINSUCLINAH
EPSS
0.37%
29.6th percentile
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libsoup3 | — | — |
| gnome | libsoup | < 3.7.3 | 3.7.3 |
| gnome | libsoup | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in libsoup.
ghsa_unreviewed·2026-09-29
CVE-2026-102555 [HIGH] CWE-125 A flaw was found in libsoup.
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
Red Hat
libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding
vendor_redhat·2026-09-03·CVSS 8.2
CVE-2026-102555 [HIGH] CWE-125 libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding
libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
Statement: This issue is rated Important. An attacker who can supply a crafted data URI to an application that uses soup_uri_decode_data_uri() may cause a heap out-of-bounds read or denial of service. Impact depends on how the application consumes the returned GBytes. Red Ha
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102555 libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding
bugzilla·2026-09-29·CVSS 8.2
CVE-2026-102555 [HIGH] CVE-2026-102555 libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding
CVE-2026-102555 libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding
A heap buffer overflow condition was found in libsoup's soup_uri_decode_data_uri().
After percent-decoding a data URI payload marked ;base64, the code called g_base64_decode_inplace(), which measures input with strlen(). Percent-decoded content can contain embedded NUL bytes (for example data:;base64,A%00B), so the measured length was too short. g_base64_decode_inplace() returned without writing a valid output length; the uninitialized length was then stored as the size of the returned GBytes, allowing callers to read past the allocation.
Fixed upstream by decoding with g_base64_decode_step() using the real buffer length (commit e4f03226, libsoup 3.7.3).
References:
https://gitla
Bugzilla
CVE-2026-102555 mingw-libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding [fedora-all]
bugzilla·2026-09-29·CVSS 8.2
CVE-2026-102555 [HIGH] CVE-2026-102555 mingw-libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding [fedora-all]
CVE-2026-102555 mingw-libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow condition was found in libsoup's soup_uri_decode_data_uri().
After percent-decoding a data URI payload marked ;base64, the code called g_base64_decode_inplace(), which measures input with strlen(). Percent-decoded content can contain embedded NUL bytes (for example data:;base64,A%00B), so the measured length was too short. g_base64_decode_inplace() returned without writing a valid output length; the uninitialized length
Bugzilla
CVE-2026-102555 libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding [fedora-all]
bugzilla·2026-09-29·CVSS 8.2
CVE-2026-102555 [HIGH] CVE-2026-102555 libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding [fedora-all]
CVE-2026-102555 libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow condition was found in libsoup's soup_uri_decode_data_uri().
After percent-decoding a data URI payload marked ;base64, the code called g_base64_decode_inplace(), which measures input with strlen(). Percent-decoded content can contain embedded NUL bytes (for example data:;base64,A%00B), so the measured length was too short. g_base64_decode_inplace() returned without writing a valid output length; the uninitialized length was t
Bugzilla
CVE-2026-102555 libsoup3: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding [fedora-all]
bugzilla·2026-09-29·CVSS 8.2
CVE-2026-102555 [HIGH] CVE-2026-102555 libsoup3: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding [fedora-all]
CVE-2026-102555 libsoup3: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A heap buffer overflow condition was found in libsoup's soup_uri_decode_data_uri().
After percent-decoding a data URI payload marked ;base64, the code called g_base64_decode_inplace(), which measures input with strlen(). Percent-decoded content can contain embedded NUL bytes (for example data:;base64,A%00B), so the measured length was too short. g_base64_decode_inplace() returned without writing a valid output length; the uninitialized length was
2026-09-29
Published