The libsoup library, which provides HTTP client and server functionality for GNOME, contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in the NTLM authentication code path, potentially leading to memory corruption. CVE-2026-1761 involves a stack-based buffer overflow during the parsing of multipart HTTP responses. These vulnerabilities could allow an attacker to cause a denial of service or potentially execute arbitrary code. Red Hat has released updated libsoup packages for Red Hat Enterprise Linux 8.8 variants to fix these issues.

Successful exploitation of these vulnerabilities could result in a stack-based buffer overflow, which may lead to application crashes or potentially arbitrary code execution in the context of the affected application. The vulnerabilities affect libsoup's handling of NTLM authentication and multipart HTTP response parsing, which are critical components for HTTP communications. No known exploits in the wild have been reported at this time.

Red Hat has released updated libsoup packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 8.8 variants should apply the security update as detailed in Red Hat Advisory RHSA-2026:1948. For instructions on applying the update, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.