The libsoup library in Red Hat Enterprise Linux 8.6 contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in NTLM authentication code, potentially leading to memory corruption. CVE-2026-1761 involves a stack-based buffer overflow during parsing of multipart HTTP responses. Both vulnerabilities could allow an attacker to cause memory corruption, potentially leading to denial of service or code execution. Red Hat has issued security updates to fix these vulnerabilities in libsoup packages for multiple Red Hat Enterprise Linux 8.6 variants.

Successful exploitation of these vulnerabilities could result in stack-based buffer overflows, which may allow an attacker to crash affected applications or execute arbitrary code with the privileges of the vulnerable process. The vulnerabilities affect HTTP client and server functionality in libsoup, which is widely used in GNOME environments on Red Hat Enterprise Linux 8.6. The severity is rated as high by Red Hat Product Security.

Red Hat has released updated libsoup packages that address these vulnerabilities for Red Hat Enterprise Linux 8.6 variants. Users should apply the official security updates as described in Red Hat advisory RHSA-2026:2512 and the referenced article https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified. Applying the vendor-provided patches fully mitigates these issues.