CVE-2026-66337 — Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP respo…
Published: 2026-07-24 · CVSS: 6.5 · CVSS 3.1
A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7