The vulnerability arises because the integer overflow guard introduced in libsoup 3.6.6 to fix CVE-2026-0716 was applied only to masked WebSocket frames. Unmasked server-to-client frames remain unprotected, allowing a malicious WebSocket server to send an unmasked frame with a payload length near UINT64_MAX. When libsoup's max_incoming_payload_size is set to 0, this can trigger an out-of-bounds read in the client. This issue is rated moderate by Red Hat due to the requirement of a non-default configuration (max_incoming_payload_size=0 or unset).

An attacker controlling a WebSocket server can cause a libsoup-based client to perform an out-of-bounds read, potentially disclosing sensitive memory contents such as cryptographic keys or other confidential information. The impact includes limited confidentiality loss and possible application instability. The vulnerability requires a non-default configuration, reducing the likelihood of exploitation in typical environments.

Red Hat advises that applications using libsoup's WebSocket support explicitly set max_incoming_payload_size to a non-zero value to prevent processing of frames with an unset or zero maximum payload size. This configuration change mitigates the vulnerability by preventing out-of-bounds reads. No patch is explicitly mentioned; mitigation relies on configuration. Users should consult their application documentation for configuring this parameter appropriately.