CVE-2025-12105: Libsoup: heap use-after-free in libsoup message queue handling during http/2 read completion
GNOME · libsoup
Vendor fix available · Affected: GNOME libsoup · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 40% of scored CVEs
DescriptionCVE.org
A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications. When network operations are aborted at specific timing intervals, an internal message queue item may be freed twice due to missing state synchronization. This leads to a use-after-free memory access, potentially crashing the affected application. Attackers could exploit this behavior remotely by triggering specific HTTP/2 read and cancel sequences, resulting in a denial-of-service condition.
Affected products7
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- GNOME · libsoupup to and including 3.6.5
- Red Hat · Red Hat Enterprise Linux 10Versions not stated
- Red Hat · Red Hat Enterprise Linux 10.0 Extended Update SupportVersions not stated
- Red Hat · Red Hat Enterprise Linux 6Versions not stated
- Red Hat · Red Hat Enterprise Linux 7Versions not stated
- Red Hat · Red Hat Enterprise Linux 8Versions not stated
- Red Hat · Red Hat Enterprise Linux 9Versions not stated
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- GNOME
- Published
- October 2025
CoverageNo articles yet
No CyberSIXT article names CVE-2025-12105 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.