CVE-2026-12478 Details
Description
The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.
A vulnerability in GNOME Libsoup's WebSocket frame processing can lead to an out-of-bounds read. This issue arises when a WebSocket server sends an unmasked frame with a payload length close to UINT64_MAX. The vulnerability is present in Libsoup versions prior to 3.6.6, when the maximum incoming payload size is set to 0 or left unset. Under these conditions, the Libsoup-based client may read memory outside of the intended bounds, potentially causing memory disclosure or application instability.
Applications using Libsoup's WebSocket support should set the 'max_incoming_payload_size' to a non-zero value. This adjustment prevents the library from processing WebSocket frames with an unset or zero maximum payload size, which can lead to out-of-bounds reads.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | [email protected] |
| Sep 15, 2026 | CVE Modified | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 14, 2026 | New CVE Received | [email protected] |