UBUNTU-CVE-2026-12478: Integer Overflow
The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64MAX to trigger an OOB read in a libsoup-based client when maxincomingpayloadsize is set to 0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set max_incoming_payload_size to a non-zero value instead of 0 to avoid the unbounded payload condition.
libsoup-based client max_incoming_payload_size = non-zero
Event History
Frequently Asked Questions
Which deployments are exposed?
The affected component is a libsoup-based client that receives WebSocket frames from a malicious server. The vulnerable path applies to unmasked server-to-client frames.
What configuration is required for exploitation?
The client must have max_incoming_payload_size set to 0. The malicious server must send a crafted unmasked WebSocket frame with a payload length near UINT64_MAX.
Does exploitation require authentication or user interaction?
No privileges or user interaction are indicated by the provided CVSS vector. Exploitation requires network delivery of the crafted frame from a malicious WebSocket server to the affected client.