The vulnerability arises from an incomplete fix of a prior out‑of-bounds read flaw in libsoup’s WebSocket frame processing. The integer overflow guard was placed only inside the if (masked) block, leaving unmasked server‑to‑client frames exposed. A malicious WebSocket server can send an unmasked frame with a payload length near the maximum 64‑bit value when libsoup’s max_incoming_payload_size is set to zero, triggering an out‑of‑bounds read in a libsoup‑based client, which may expose memory contents or cause a crash.

The issue affects Red Hat Enterprise Linux 10 systems that ship the vulnerable libsoup library. Any application on these systems that relies on the default libsoup WebSocket handling, particularly those that do not configure a maximum incoming payload

The CVSS score of 4.8 reflects low‑to‑moderate severity; the EPSS score of < 1% points to a low exploitation likelihood, and the flaw is not included in the CISA KEV catalog. To exploit the flaw ancoming_payload_size set to zero. The out‑of‑bounds read that results may crash the client or expose memory contents.