The vulnerability exists in libsoup's soup_uri_decode_data_uri() function, which incorrectly handles base64 data-URI payloads by treating them as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contains embedded NUL bytes, the decoded length may remain uninitialized and be used as the size of the returned GBytes, leading to a heap out-of-bounds read or application crash. This issue affects Red Hat Enterprise Linux 10 where libsoup is widely used by GNOME and other HTTP clients. The impact depends on how the application consumes the returned GBytes. The flaw can cause denial of service or potentially leak memory contents.

An attacker who can supply a crafted data URI to an application using soup_uri_decode_data_uri() may cause a heap out-of-bounds read or denial of service via application crash. Confidentiality impact is low but may allow reading of memory contents that could aid further attacks. Availability impact is high due to potential application crashes. Integrity is not affected. The overall impact depends on the consuming application's use of the decoded data.

Red Hat advises not to pass untrusted data URIs to the soup_uri_decode_data_uri() function to mitigate this vulnerability. No official patch or fix status is provided in the advisory, so patch status is not yet confirmed — check the Red Hat advisory for updates. Until a fix is available, avoid processing untrusted data URIs with this function.