CVE-2025-32911: libsoup2.4 Free of Memory not on the Heap

Vulnerability summary

CVE-2025-32911 is a critical (CVSS 9.0) Free of Memory not on the Heap vulnerability in libsoup2.4. EPSS estimates a 0.97% chance of exploitation in the next 30 days, higher than 61.1% of scored vulnerabilities.

Timeline

1. 15-04-2025
   PublishedVulnerability first disclosed.
2. 29-06-2026
   Last modifiedVulnerability information updated.

Description

A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.

• CWE-590Free of Memory not on the HeapThe product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().