This advisory covers two security vulnerabilities in libsoup used by spice-client-win MSI installers for Windows clients in Red Hat Enterprise Linux 8.8. CVE-2026-0719 is a stack-based buffer overflow caused by a signed to unsigned conversion error during NTLM authentication. CVE-2026-1761 is another stack-based buffer overflow triggered during multipart HTTP response parsing. Both vulnerabilities could potentially lead to memory corruption. Red Hat has released updated spice-client-win packages for affected RHEL 8.8 variants to fix these issues.

Successful exploitation of these vulnerabilities could result in stack-based buffer overflows, potentially allowing an attacker to cause memory corruption. The exact impact depends on the context of use but may include denial of service or code execution. Red Hat rates the security impact as Important (high severity). There are no known exploits in the wild at this time.

Red Hat has released updated spice-client-win packages for Red Hat Enterprise Linux 8.8 variants that address these vulnerabilities. Users should apply the security updates as described in the Red Hat advisory RHSA-2026:2528 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are specified or required beyond applying the official patches.