UBUNTU-CVE-2026-102555: High severity ubuntu/libsoup2.4 vulnerability
A flaw was found in libsoup. The soupuridecodedatauri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling gbase64decodeinplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.
Affected Software
Event History
Frequently Asked Questions
Which Ubuntu components should be reviewed for exposure?
Review systems using ubuntu/libsoup2.4 or ubuntu/libsoup3, particularly applications that process data URIs originating from untrusted sources.
What does an attacker need to trigger the issue?
The attack requires a crafted base64 data URI whose percent-decoded payload includes embedded NUL bytes. The supplied severity vector indicates network reachability, low attack complexity, no privileges, and no user interaction.
What is the likely operational impact?
Processing the crafted URI can cause an out-of-bounds read or crash in the application. The supplied vector rates availability impact as high and confidentiality impact as low.