CVE-2025-32052: libsoup2.4 Buffer Over-read

CVSS: 6.5v3.1MediumDeferred

AliasesUBUNTU-CVE-2025-32052DEBIAN-CVE-2025-32052

Published 03-04-2025Last modified 30-06-2026

Vulnerability summary

CVE-2025-32052 is a medium (CVSS 6.5) Buffer Over-read vulnerability in libsoup2.4. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.4% of scored vulnerabilities.

Overall risk

26/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.66%

0%100%

Low · +0.01 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

03-04-2025
PublishedVulnerability first disclosed.
30-06-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.

CVSS metrics

4 scores · 4 sources · 1 version

v3.16.5

EPSS trend

Probability

0.66%

Chance of exploitation in the next 30 days

Percentile

50%

Versus all other CVEs

30-day change

+0.01 pp

From 0.65% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.66%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Affected systems

Debian2 products

libsoup2.4All versions (No fix recorded) | < 2.74.3-10
libsoup3< 3.2.3-0+deb12u1 | < 3.6.1-1

Ubuntu2 products

libsoup2.4< 2.52.2-1ubuntu0.3+esm4 | < 2.62.1-1ubuntu0.4+esm5 | < 2.70.0-1ubuntu0.2 | < 2.74.2-3ubuntu0.2 | < 2.74.3-6ubuntu1.2
libsoup3< 3.0.7-0ubuntu1+esm2 | < 3.4.4-5ubuntu0.2

2 vendors · 4 products