The vulnerability CVE-2026-12478 affects libsoup in Red Hat Enterprise Linux 10. It results from a misplaced integer overflow guard that only protects masked frames, leaving unmasked server-to-client WebSocket frames vulnerable. An attacker controlling a malicious WebSocket server can send a specially crafted unmasked frame with a payload length close to UINT64_MAX, causing an out-of-bounds read in the client when max_incoming_payload_size is configured to 0. This flaw is a regression from the fix for CVE-2026-0716. No official remediation level or patch is explicitly stated in the advisory, and no known exploits in the wild have been reported.

The vulnerability allows a remote attacker (a malicious WebSocket server) to cause an out-of-bounds read in a libsoup-based client, potentially leading to information disclosure or application instability. The CVSS score of 4.8 reflects a medium severity with low confidentiality impact, no integrity impact, and low availability impact. Exploitation requires a high attack complexity and no privileges or user interaction.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12478 for current remediation guidance. Since no official fix or remediation level is provided in the advisory content, users should monitor vendor updates closely. Avoid setting max_incoming_payload_size to 0 as a temporary measure to reduce exposure until a patch is available.