The vulnerability CVE-2026-12478 affects libsoup in Red Hat Enterprise Linux 10. It stems from an incomplete fix for CVE-2026-0716 where the integer overflow guard was placed only inside the conditional block handling masked frames. This omission leaves unmasked server-to-client WebSocket frames vulnerable. An attacker controlling a malicious WebSocket server can send a specially crafted unmasked frame with a payload length close to UINT64_MAX, triggering an out-of-bounds read in the client when the max_incoming_payload_size parameter is set to zero.

The vulnerability can lead to an out-of-bounds read in libsoup-based clients, potentially causing application crashes or information disclosure. The CVSS 3.1 score is 4.8 (medium severity), indicating limited confidentiality impact, no integrity impact, and low availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed—check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12478 for current remediation guidance. Since no official fix or workaround is explicitly stated in the advisory content provided, users should monitor Red Hat communications for updates. Avoid setting max_incoming_payload_size to 0 as a temporary precaution if applicable.