CVE-2026-102555

A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.

This issue is rated Important. An attacker who can supply a crafted data URI to an application that uses soup_uri_decode_data_uri() may cause a heap out-of-bounds read or denial of service. Impact depends on how the application consumes the returned GBytes. Red Hat Enterprise Linux ships libsoup/libsoup3 widely used by GNOME and other HTTP clients; applications that decode untrusted data URIs are in scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this do not pass untrusted data URIs to soup_uri_decode_data_uri().