CVE-2025-32050: libsoup2.4 Buffer Under-read

CVSS: 5.9v3.1MediumDeferred

AliasesUBUNTU-CVE-2025-32050DEBIAN-CVE-2025-32050

Published 03-04-2025Last modified 30-06-2026

Vulnerability summary

CVE-2025-32050 is a medium (CVSS 5.9) Buffer Under-read vulnerability in libsoup2.4. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.6% of scored vulnerabilities.

Overall risk

24/100

0100

Low · default modelHow is this calculated?

CVSS score

5.9/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.77%

0%100%

Low · +0.01 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

03-04-2025
PublishedVulnerability first disclosed.
30-06-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.

CVSS metrics

4 scores · 4 sources · 1 version

v3.15.9

EPSS trend

Probability

0.77%

Chance of exploitation in the next 30 days

Percentile

55%

Versus all other CVEs

30-day change

+0.01 pp

From 0.75% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.77%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-127Buffer Under-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.

Affected systems

Debian2 products

libsoup2.4All versions (No fix recorded) | < 2.74.3-10
libsoup3< 3.2.3-0+deb12u1 | < 3.6.1-1

Ubuntu2 products

libsoup2.4< 2.52.2-1ubuntu0.3+esm4 | < 2.62.1-1ubuntu0.4+esm5 | < 2.70.0-1ubuntu0.2 | < 2.74.2-3ubuntu0.2 | < 2.74.3-6ubuntu1.2
libsoup3< 3.0.7-0ubuntu1+esm2 | < 3.4.4-5ubuntu0.2

2 vendors · 4 products