6.5

CVE-2025-32910: libsoup2.4 NULL Pointer Dereference

CVSS: 6.5v3.1MediumDeferred
AliasesUBUNTU-CVE-2025-32910DEBIAN-CVE-2025-32910
Published 14-04-2025Last modified 15-09-2026
Open JSON

Vulnerability summary

CVE-2025-32910 is a medium (CVSS 6.5) NULL Pointer Dereference vulnerability in libsoup2.4. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 38% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.45%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 12
DLA-4140-1MGASA-2025-0261OPENSUSE-SU-2025:15189-1RHSA-2025:8292SUSE-SU-2025:01504-1SUSE-SU-2025:01794-1

Timeline

  1. 14-04-2025
    PublishedVulnerability first disclosed.
  2. 15-09-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client to crash.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.45%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

+0.01 pp

From 0.45% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.45%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • libsoup2.4All versions (No fix recorded) | < 2.74.3-10.1
  • libsoup3< 3.2.3-0+deb12u1 | < 3.6.4-1
Ubuntu2 products
  • libsoup2.4< 2.52.2-1ubuntu0.3+esm1 | < 2.62.1-1ubuntu0.4+esm2 | < 2.70.0-1ubuntu0.3 | < 2.74.2-3ubuntu0.3 | < 2.74.3-6ubuntu1.3
  • libsoup3< 3.0.7-0ubuntu1+esm3 | < 3.4.4-5ubuntu0.3

2 vendors · 4 products

References

12 links
Show all 12 references