{"id":"CVE-2026-12478","title":"The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected","summary":"The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked fram…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","cwe":["CWE-125"],"vendor":"Red Hat","product":"libsoup3","affected":["libsoup3","libsoup","libsoup","libsoup","libsoup"],"published":"2026-07-14","updated":"2026-09-16","sourceUpdated":"2026-09-16T09:17:03.437","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12478","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-12478","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489655","label":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/518","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12478.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12478"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12478"}],"tags":["nvd","exploit-available","cve.org","csaf","vex","red-hat"],"epss":0.00388,"epssPercentile":0.32636,"exploits":{"github":1,"githubRepos":["https://github.com/Popy21/security-research"],"checkedAt":"2026-09-21T15:27:55.412Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-15T14:42:08.156943Z"},"ingestedAt":"2026-09-15T20:44:02.379Z","slug":"CVE-2026-12478","body":"## Overview\n\nThe fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12478.json)","depth":"twilight","depthScore":38,"depthScoreParts":{"impact":26.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}