CVE-2026-105958
7.5HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-787
Impact
An authenticated SPICE client can corrupt heap memory or read sensitive heap data during VM live migration, potentially leading to denial of service or code execution. The attacker must already have network access to the SPICE server and valid client credentials.
Root cause
Migration data handlers in spice-server fail to validate client-supplied offsets in SPICE_MSGC_MIGRATE_DATA messages, triggering out-of-bounds reads and writes on the message buffer.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the patch from spice merge request 257 or update spice-server once your distribution releases a patched package. If patching must wait, restrict SPICE client access to trusted networks and avoid live migration while untrusted clients are connected.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.