Two security flaws in libsoup, a library used by spice-client-win MSI installers for Windows clients, have been identified: CVE-2026-0719 is a signed to unsigned conversion error causing a stack-based buffer overflow during NTLM authentication, and CVE-2026-1761 is a stack-based buffer overflow in multipart HTTP response parsing. Both vulnerabilities could allow memory corruption leading to potential security risks. Red Hat Product Security has rated the update as Important and released patches for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service. The advisory references fixes in spice-client-win packages version 8.10-7.el8_8.1 and related source RPMs.

Successful exploitation of these vulnerabilities could result in stack-based buffer overflows, potentially allowing an attacker to execute arbitrary code or cause denial of service on affected systems running spice-client-win. The vulnerabilities affect the libsoup library used in NTLM authentication and multipart HTTP response parsing within the spice-client-win MSI installers for Windows clients on Red Hat Enterprise Linux 8.8. The severity is rated as high by the source data, and Red Hat classifies the update as Important.

Red Hat has released security updates addressing these vulnerabilities in spice-client-win packages for Red Hat Enterprise Linux 8.8 variants. Users should apply the updates as described in the Red Hat advisory RHSA-2026:2528 and the referenced article https://access.redhat.com/articles/11258. There is no indication that no action is required; therefore, applying the official patches is the recommended mitigation. Patch status is confirmed by the vendor advisory.