The vulnerability CVE-2025-4969 in libsoup results from failure to correctly verify the termination of multipart HTTP messages. This allows a remote attacker to send specially crafted multipart HTTP bodies that trigger out-of-bounds reads on the server consuming libsoup. The CVSS 3.1 base score is 6.5, indicating medium severity with network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, and low availability impact. The affected product is Red Hat Enterprise Linux 10. The vendor advisory is available but does not explicitly state patch or mitigation details.

Successful exploitation can cause the vulnerable server to read memory beyond its allocated boundaries, potentially leading to information disclosure or application instability. The impact is limited to confidentiality and availability with no integrity impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-4969 for current remediation guidance. Until a patch is confirmed, consider restricting exposure of services using libsoup to untrusted networks to reduce risk.