CVE-2026-0719 is a stack-based buffer overflow vulnerability in the NTLM authentication component of the libsoup HTTP library used by GNOME and other applications. The vulnerability is caused by a signed to unsigned integer conversion error during size calculation for extremely long passwords, resulting in incorrect stack memory allocation and unsafe copying operations. This can lead to application crashes and denial-of-service. Red Hat has released security updates fixing this issue in libsoup packages for Red Hat Enterprise Linux versions 8.8, 9.2, and their respective update services. The vulnerability is tracked under CWE-121 (stack-based buffer overflow) and carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H). No exploits are currently known in the wild.

Successful exploitation of this vulnerability can cause applications using the libsoup library to crash unexpectedly, leading to denial-of-service conditions. The impact affects confidentiality and integrity to a limited extent (low), but availability impact is high due to potential application crashes. There are no reports of exploitation in the wild.

Red Hat has released official security updates that fix this vulnerability in the libsoup packages for Red Hat Enterprise Linux 8.8, 9.2, and related variants. Users should apply these updates promptly to remediate the issue. Detailed update instructions are available in the Red Hat advisories and knowledge base articles linked in the vendor advisory. No additional mitigation actions are required beyond applying the official patches.