An out-of-bounds read vulnerability exists in libsoup's multipart processing within Red Hat Enterprise Linux 10, specifically in the soup_multipart_input_stream_read_headers() function. This function fails to properly validate the size of incoming multipart boundary strings, allowing a remote unauthenticated attacker to cause the internal stream reader to read past buffer boundaries when processing crafted HTTP responses. The impact includes potential denial of service due to application failure and possible exposure of memory metadata fragments. The vulnerability is publicly known with no confirmed exploits in the wild and no explicit remediation or patch details disclosed in the vendor advisory.

A remote, unauthenticated attacker can exploit this vulnerability to cause a denial of service by crashing the application processing the multipart data. Additionally, there is a potential for reading unauthorized memory fragments, which may lead to information disclosure. The CVSS score of 6.5 reflects a medium severity impact with low complexity and no privileges required for exploitation.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15714 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Monitor the vendor advisory for updates and apply any patches or mitigations once available.