The Red Hat security advisory RHSA-2026:2513 reports two vulnerabilities in libsoup components used by spice-client-win MSI installers for Windows clients. CVE-2026-0719 is a stack-based buffer overflow caused by a signed to unsigned conversion error during NTLM authentication. CVE-2026-1761 is a stack-based buffer overflow triggered by improper parsing of multipart HTTP responses. Both vulnerabilities could lead to memory corruption. The advisory covers Red Hat Enterprise Linux 8.2 AUS spice-client-win packages and provides updated packages to remediate these issues.

Successful exploitation of these vulnerabilities could result in stack-based buffer overflows, potentially allowing an attacker to execute arbitrary code or cause denial of service in the context of the affected spice-client-win application. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated spice-client-win packages for Red Hat Enterprise Linux 8.2 AUS that address these vulnerabilities. Users should apply the security update as described in Red Hat article 11258 to remediate the issues. No additional mitigation steps are indicated by the vendor advisory.