Bug 2427906 (CVE-2026-0719)

Summary: CVE-2026-0719 libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2427907, 2427908, 2427909, 2427910, 2427911, 2427912    
Bug Blocks:    

Description OSIDB Bzimport 2026-01-08 12:14:54 UTC 
A stack-based buffer overflow vulnerability exists in the md4sum() function of libsoup’s NTLM authentication module (SoupAuthNTLM). When NTLM authentication is enabled, insufficient bounds checking on stack-allocated buffers can allow a local attacker to overwrite adjacent memory. This may result in arbitrary code execution with the privileges of the affected application. Multiple widely deployed components, including WebKit, Evolution, GVfs, and gnome-online-accounts, enable NTLM by default, increasing exposure.