CVE-2026-2443: Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure
CVE-2026-2443 is a vulnerability in Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure, rated Moderate by Microsoft, with a CVSS 3.1 base score of 5.3 (Medium). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.49% probability of exploitation activity in the next 30 days, higher than 42% of all scored vulnerabilities. Microsoft released the fix on 21 February 2026 in the February 2026 Patch Tuesday. It affects 7 products in 1 product family (Other).