The libsoup library, which provides HTTP client and server functionality for GNOME, contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in the NTLM authentication code path, potentially leading to memory corruption. CVE-2026-1761 involves a stack-based buffer overflow during multipart HTTP response parsing. Both vulnerabilities have been addressed in updated libsoup packages provided by Red Hat for Red Hat Enterprise Linux 8.2 AUS. The advisory references Red Hat Bugzilla entries 2427906 and 2435961 for these fixes.

Successful exploitation of these vulnerabilities could result in a stack-based buffer overflow, which may lead to application crashes or potentially arbitrary code execution within the context of the vulnerable libsoup library. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated libsoup packages for Red Hat Enterprise Linux 8.2 AUS that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:2396 and the related article https://access.redhat.com/articles/11258. Applying the official update is the recommended and effective mitigation. No additional mitigation steps are indicated by the vendor.