The vulnerability CVE-2026-1761 affects the libsoup library, which provides HTTP client and server functionality for GNOME. It is a stack-based buffer overflow caused by incorrect length calculation when parsing multipart HTTP responses. Exploitation involves a remote attacker sending a crafted multipart HTTP response to an application using libsoup, leading to memory corruption. This can result in application crashes or arbitrary code execution. Red Hat has released security updates addressing this issue in libsoup packages for multiple Red Hat Enterprise Linux versions, including 8.8 and 9.2. The vulnerability has a CVSS 3.1 base score of 8.6 (high severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to memory corruption in applications using libsoup to parse multipart HTTP responses. This may cause application crashes or allow arbitrary code execution, potentially compromising the affected system. The vulnerability does not require authentication or user interaction, increasing its risk. The CVSS score of 8.6 reflects a high severity impact on confidentiality, integrity, and availability.

Red Hat has released official security updates that fix this vulnerability in the libsoup packages for Red Hat Enterprise Linux 8.8, 9.2, and related variants. Users should apply the relevant security updates as described in the Red Hat advisories RHSA-2026:1948 and RHSA-2026:2005. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor advisory beyond applying these updates.