Libsoup3, a C-based HTTP library designed for asynchronous network communication in GNOME applications, contains two stack-based buffer overflow vulnerabilities. CVE-2026-0719 arises from a signed to unsigned conversion error in the NTLM authentication code path, potentially causing a buffer overflow. CVE-2026-1761 involves a buffer overflow in the parsing of multipart HTTP responses. Both vulnerabilities are categorized under CWE-121 (stack-based buffer overflow). Red Hat has released updated libsoup3 packages for Red Hat Enterprise Linux 10 and associated CodeReady Linux Builder variants to remediate these issues.

Successful exploitation of these vulnerabilities could result in stack-based buffer overflows, which may lead to application crashes or potentially arbitrary code execution within the context of the affected application. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated libsoup3 packages (version 3.6.5-3.el10_1.9 and later) that fix these vulnerabilities. Users of Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products should apply these updates promptly. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor advisory.