This vulnerability is a heap buffer overflow in libsoup that occurs while constructing a masked WebSocket client frame for a very large outgoing payload. Size values passed to GByteArray allocation APIs can be truncated, yet the masking routine continues to use the full length, allowing data to be written beyond the allocated buffer bounds. An attacker who can deliver a crafted WebSocket message that triggers this overflow can potentially execute arbitrary code or crash the application. The weakness is classified as CWE‑125 (Out‑of‑bounds Read or Write).

All supported Red Hat Enterprise Linux distributions from version 6 through 10 are affected, because the flaw resides in the libsoup component bundled with these operating systems. No specific library versions are enumerated, so any installation that includes the vulnerable libsoup library version is potentially impacted.

The CVSS score of 8.6 signals a high severity. The flaw is exploitable remotely over the network via a WebSocket connection, and although an EPSS score is not available, the absence of a KEV listing does not reduce the risk. Therefore, the flaw should be treated as highly likely to be exploited by attackers who can send specialized WebSocket frames.