CVE-2025-32051

A denial-of-service vulnerability exists in libsoup up to version 3.6.0. The flaw resides in the soup_uri_decode_data_uri() function, which may crash when processing a specially crafted, malformed data URI [1][2]. The root cause is improper handling of malformed input, leading to a segmentation fault under certain conditions [2].

An attacker can trigger this crash by providing a data URI that does not conform to the expected format. The attack is network-based, as the URI would typically be parsed by an application using libsoup to handle incoming data. No authentication is required, making the attack vector accessible to any remote attacker able to deliver the malformed URI to the vulnerable library [1][2].

The primary impact is a denial of service (DoS), as the crash causes the application to terminate or become unavailable. The CVSS v3 base score is 5.9 (Medium), reflecting the ease of exploitation and the availability impact, but no impact on confidentiality or integrity [1]. The flaw has been addressed in libsoup version 3.6.1, and users are advised to update to the fixed version to mitigate the risk [2].