CVE-2024-52531: gnome libsoup Out-of-bounds Write

CVSS: 6.5v3.1MediumModified

AliasesRHSA-2025:0791RHSA-2025:0838RHSA-2025:0847+9 more

Published 11-11-2024Last modified 03-11-2025

Vulnerability summary

CVE-2024-52531 is a medium (CVSS 6.5) Out-of-bounds Write vulnerability in gnome libsoup. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

36/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.68%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 15 · Related 13

DLA-3992-1 MGASA-2024-0382 OPENSUSE-SU-2024:14488-1 OPENSUSE-SU-2024:14489-1 SUSE-SU-2024:4290-1 SUSE-SU-2024:4349-1+9 more

Timeline

11-11-2024
PublishedVulnerability first disclosed.
03-11-2025
Last modifiedVulnerability information updated.

Description

GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausible way to reach this remotely via soup_message_headers_get_content_type (e.g., an application may want to retrieve the content type of a request or response).

CVSS metrics

5 scores · 5 sources · 1 version

v3.16.5

EPSS trend

Probability

0.68%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

0.00 pp

From 0.68% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.68%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (offsec.almond.consulting)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Redhat4 products

libsoup< 0:2.72.0-8.el9_5.3 | < 0:2.62.3-7.el8_10 | < 0:2.72.0-8.el9_2.3 | < 0:2.72.0-8.el9_4.3 | < 0:2.72.0-8.el9_0.3 | < 0:2.62.3-2.el8_4.2 | < 0:2.62.3-1.el8_2.2 | < 0:2.62.3-2.el8_6.2 | < 0:2.62.2-4.el7_9 | < 0:2.62.3-3.el8_8.2
libsoup-debuginfo< 0:2.72.0-8.el9_5.3 | < 0:2.62.3-7.el8_10 | < 0:2.72.0-8.el9_2.3 | < 0:2.72.0-8.el9_4.3 | < 0:2.72.0-8.el9_0.3 | < 0:2.62.3-2.el8_4.2 | < 0:2.62.3-2.el8_6.2 | < 0:2.62.2-4.el7_9 | < 0:2.62.3-3.el8_8.2
libsoup-debugsource< 0:2.72.0-8.el9_5.3 | < 0:2.62.3-7.el8_10 | < 0:2.72.0-8.el9_2.3 | < 0:2.72.0-8.el9_4.3 | < 0:2.72.0-8.el9_0.3 | < 0:2.62.3-2.el8_4.2 | < 0:2.62.3-2.el8_6.2 | < 0:2.62.3-3.el8_8.2
libsoup-devel< 0:2.72.0-8.el9_5.3 | < 0:2.62.3-7.el8_10 | < 0:2.72.0-8.el9_2.3 | < 0:2.72.0-8.el9_4.3 | < 0:2.72.0-8.el9_0.3 | < 0:2.62.3-2.el8_4.2 | < 0:2.62.3-2.el8_6.2 | < 0:2.62.2-4.el7_9 | < 0:2.62.3-3.el8_8.2

Debian2 products

libsoup2.4< 2.74.3-1+deb12u1 | < 2.74.3-8.1
libsoup3< 3.2.3-0+deb12u1 | < 3.6.0-4

Ubuntu2 products

libsoup2.4< 2.52.2-1ubuntu0.3+esm4 | < 2.62.1-1ubuntu0.4+esm1 | < 2.70.0-1ubuntu0.1 | < 2.74.2-3ubuntu0.1 | < 2.74.3-6ubuntu1.1
libsoup3< 3.0.7-0ubuntu1+esm1 | < 3.4.4-5ubuntu0.1

Gnome1 product