CVE-2026-105959
7.5HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-190
Impact
An authenticated SPICE client can trigger a massive heap buffer overflow during VM live migration, potentially crashing the hypervisor host or executing code in the host process context. Exploitation requires network access to the SPICE interface and active migration.
Root cause
The GLZ encoder dictionary restore routine truncates an allocation size from size_t to int when invoking the malloc callback, allowing an integer overflow.
Affected systems
spice-server (versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the patch from spice merge request 253 or the latest vendor spice-server package. As an interim workaround, restrict SPICE client access or disable live migration across untrusted networks.
$ rpm -q spice-server || dpkg -l spice-serverAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.