This vulnerability arises from an unsigned integer underflow in the libsoup library's soup_filter_input_stream_read_until() function. When parsing multipart HTTP responses, this flaw causes a heap buffer over-read, which can be triggered by a malicious HTTP server sending a specially crafted multipart response. The impact includes potential client application crashes or leakage of sensitive heap memory. The vulnerability affects Red Hat Enterprise Linux 10, but no specific affected versions or patch information is provided in the available data. The CVSS v3.1 base score is 6.5, indicating medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and low availability impact.

Exploitation of this vulnerability can lead to client application crashes or disclosure of sensitive heap memory due to a heap buffer over-read. This could impact confidentiality and availability of the affected system. There is no indication of integrity impact. The vulnerability can be triggered remotely without authentication or user interaction.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-66337 for current remediation guidance. No official fix or workaround details are provided in the available information. Users should monitor the vendor advisory for updates and apply patches once available.