CVE-2026-105959

HighCVSS 7.5

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Summary

A flaw was found in spice-server where the GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback. An authenticated malicious SPICE client during VM live migration can trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.

Risk Assessment

A malicious authenticated SPICE client can trigger a heap buffer overflow in the spice-server process, potentially leading to a service crash or possible code execution.

Recommendation

Update spice-server to a version containing the allocation size truncation fix in the GLZ dictionary restore path and restrict access to the SPICE interface to trusted clients only.

Other vulnerabilities in spice-server

CVE-2026-105958High
A flaw was found in spice-server where multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation. An authenticated malicious SPICE client during VM live migration can read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.

Original NVD description (English source)

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS