CVE-2026-1761 is a stack-based buffer overflow vulnerability in libsoup's multipart HTTP response parsing caused by incorrect length calculation. This flaw allows remote attackers to send specially crafted multipart HTTP responses that trigger memory corruption, potentially resulting in application crashes or arbitrary code execution. The vulnerability does not require authentication or user interaction. Red Hat has released security updates for libsoup packages in Red Hat Enterprise Linux 8.8, 9.2, and related distributions to fix this issue, as detailed in Red Hat advisories RHSA-2026:1948 and RHSA-2026:2005. The CVSS 3.1 score is 8.6, reflecting high impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity and low impact on availability.

Exploitation of this vulnerability can lead to memory corruption in applications using libsoup to parse multipart HTTP responses. This may cause application crashes or allow arbitrary code execution, compromising the integrity of affected systems. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk of attack. There are no known exploits in the wild as of the advisory date.

Red Hat has released official security updates for libsoup packages that address this vulnerability. Users of Red Hat Enterprise Linux 8.8, 9.2, and related variants should apply the provided updates promptly. Detailed update instructions are available in Red Hat's advisory and knowledge base article (https://access.redhat.com/articles/11258). Since this is an official fix, applying the vendor-provided patches is the recommended mitigation. No additional mitigation steps are indicated by the vendor.