CVE-2026-102560: gnome libsoup Out-of-bounds Read

Vulnerability summary

CVE-2026-102560 is a critical (CVSS 9.8) Out-of-bounds Read vulnerability in gnome libsoup. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.8% of scored vulnerabilities.

Timeline

1. 29-09-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.