This advisory covers two security vulnerabilities in libsoup, a library used by spice-client-win MSI installers for Windows clients distributed with Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support. CVE-2026-0719 is a stack-based buffer overflow caused by a signed to unsigned conversion error in libsoup's NTLM authentication code. CVE-2026-1761 is a stack-based buffer overflow in libsoup's multipart HTTP response parsing. Both vulnerabilities could lead to memory corruption. Red Hat has released updated spice-client-win packages that fix these issues.

Successful exploitation of these stack-based buffer overflow vulnerabilities could lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause a denial of service on affected systems running the vulnerable spice-client-win components. The advisory rates the security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated spice-client-win packages for Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support that address these vulnerabilities. Users should apply the security update as described in Red Hat article 11258 to remediate these issues. No additional mitigations are specified by the vendor.