Heap Use-After-Free in libsoup HTTP/2 Implementation

A heap use-after-free vulnerability (CVE-2026-85197) has been identified in the libsoup library, a core networking component frequently used by GNOME applications. The flaw resides in the HTTP/2 client implementation and is triggered when an application attempts an asynchronous file upload. If a malicious server or an attacker performing a Man-in-the-Middle (MITM) interception injects a GOAWAY frame during the file body read process, the library may access freed memory. This memory corruption poses a significant security risk, as it can be leveraged by an attacker to facilitate arbitrary code execution or unauthorized information disclosure within the context of the affected GNOME application. Given that many desktop applications rely on libsoup for network connectivity, this vulnerability could be exploited to compromise user data or system integrity.

Impact

Successful exploitation of CVE-2026-85197 can lead to arbitrary code execution or memory-based information disclosure within the user session. This impacts users running GNOME-based applications that utilize libsoup for network operations. The CVSS score of 7.6 indicates a high-severity threat that could lead to full application compromise on affected Linux distributions.

Recommendation

Prioritized actions for security teams include identifying systems running libsoup and applying patches as soon as they become available from Linux distribution maintainers. Monitor for unexpected application crashes related to network-heavy tasks, as these may indicate attempted exploitation or stability issues resulting from this memory corruption vulnerability.

• Update libsoup across all Linux workstations and servers once the package maintainer releases the corrected version addressing CVE-2026-85197.
• Implement network monitoring to detect unexpected or suspicious HTTP/2 traffic patterns originating from desktop applications, which may indicate an attempt to interact with malicious server infrastructure.