The libsoup library, which provides HTTP client and server functionality for GNOME, contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in the NTLM authentication code path, potentially causing memory corruption. CVE-2026-1761 involves a stack-based buffer overflow during parsing of multipart HTTP responses. Both vulnerabilities could lead to memory corruption and potentially impact the security of applications using libsoup. Red Hat has issued security updates for Red Hat Enterprise Linux 8.6 variants to fix these vulnerabilities.

Successful exploitation of these vulnerabilities could result in stack-based buffer overflows, potentially leading to application crashes or arbitrary code execution in processes using the vulnerable libsoup library. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at this time.

Red Hat has released updated libsoup packages that address these vulnerabilities for Red Hat Enterprise Linux 8.6 variants. Users should apply the security updates as detailed in Red Hat advisory RHSA-2026:2512 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No alternative mitigations or workarounds are specified.