CVE-2025-32051

What it actually does

The soup_uri_decode_data_uri() function in libsoup crashes when fed a malformed data URI, resulting in an application-level denial of service with high availability impact but no confidentiality or integrity loss.

Why it matters to the business

Services or devices that rely on the affected firmware packages can experience unexpected crashes and service interruptions when processing certain data URIs, increasing operational downtime risk in environments with high downstream usage of these packages.

How an attack unfolds

An attacker crafts a malformed data URI and sends it over the network to a target application or service that uses the vulnerable libsoup function; the malformed input triggers an unhandled crash path, terminating the process and denying service.

How to fix it

Upgrade each affected package to the listed fixed version: iwl100-firmware to 0:39.31.5.1-99.el8_2.1, iwl1000-firmware to 1:39.31.5.1-99.el8_2.1, iwl105-firmware to 0:18.168.6.1-99.el8_2.1, iwl135-firmware to 0:18.168.6.1-99.el8_2.1, iwl2000-firmware to 0:18.168.6.1-99.el8_2.1, iwl2030-firmware to 0:18.168.6.1-99.el8_2.1, iwl3160-firmware to 1:25.30.13.0-99.el8_2.1, iwl3945-firmware to 0:15.32.2.9-99.el8_2.1, iwl4965-firmware to 0:228.61.2.24-99.el8_2.1, iwl5000-firmware to 0:8.83.5.1_1-99.el8_2.1, iwl5150-firmware to 0:8.24.2.2-99.el8_2.1, iwl6000-firmware to 0:9.221.4.1-99.el8_2.1, iwl6000g2a-firmware to 0:18.168.6.1-99.el8_2.1, iwl6000g2b-firmware to 0:18.168.6.1-99.el8_2.1, iwl6050-firmware to 0:41.28.5.1-99.el8_2.1, iwl7260-firmware to 1:25.30.13.0-99.el8_2.1, libertas-sd8686-firmware to 0:20191202-99.gite8a0f4c9.el8_2, libertas-sd8787-firmware to 0:20191202-99.gite8a0f4c9.el8_2, libertas-usb8388-firmware to 2:20191202-99.gite8a0f4c9.el8_2, libertas-usb8388-olpc-firmware to 0:20191202-99.gite8a0f4c9.el8_2, linux-firmware to 0:20191202-99.gite8a0f4c9.el8_2.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases; test the application with known-malformed data URIs in a controlled environment to confirm the crash no longer occurs.

Typical attack path

1. Identify a network-reachable service or endpoint that processes data URIs via libsoup
2. Construct a malformed data URI payload designed to trigger the crash in soup_uri_decode_data_uri()
3. Transmit the payload to the target
4. Observe process termination or service unavailability confirming successful denial of service

How to detect it

Review application and system logs for segmentation faults or crashes mentioning soup_uri_decode_data_uri or data URI processing; correlate with inbound network traffic containing data: URIs.

What your security team should do

• Apply the listed firmware package updates immediately on all Red Hat Enterprise Linux 8.2 EUS systems
• Monitor for service restarts or crashes correlated with data URI handling after patching
• Review network-accessible services for exposure to untrusted data URIs and apply input validation where feasible