This vulnerability involves an out-of-bounds read in libsoup's multipart processing, specifically in the soup_multipart_input_stream_read_headers() function within soup-multipart-input-stream.c. The function fails to adequately restrict or validate the size of incoming multipart boundary strings, allowing a remote attacker to cause the internal stream reader to read past buffer boundaries when processing a crafted HTTP response. This can result in application failure (DoS) or unauthorized memory metadata disclosure. The vulnerability affects Red Hat Enterprise Linux 10. No patch or remediation level has been explicitly stated in the vendor advisory at this time.

Exploitation of this vulnerability can cause a denial of service by crashing the affected application or service. Additionally, there is potential for reading fragments of unauthorized memory metadata, which could lead to limited information disclosure. The attack can be performed remotely without authentication.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15714 for current remediation guidance. No official fix or workaround has been explicitly stated in the provided advisory content. Users should monitor the vendor advisory for updates and apply patches once available.