THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-12478 (MEDIUM 4.8) — The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to

[NVD] CVE-2026-12478 (MEDIUM 4.8) — The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to

lownvdPublished 2026-07-14

CVE-2026-12478 CVSS: 4.8 MEDIUM Published: 2026-07-14T10:16:30.957

The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when m

Indicators of compromise

CVE-2026-12478cve
CVE-2026-0716cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-12478