Vulnerability-Lookup

UBUNTU-CVE-2026-105959 (CVE-2026-105959)

Vulnerability from osv_ubuntu – Published: 2026-10-16 12:16 – Updated: 2026-10-28 17:50 – Source website

Details

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-105959	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-105959	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2554008	REPORT
	https://gitlab.freedesktop.org/spice/spice/-/merg…	REPORT
	https://gitlab.freedesktop.org/spice/spice/-/comm…	REPORT
	https://gitlab.freedesktop.org/spice/spice/-/comm…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-server1",
            "binary_version": "0.12.4-0nocelt2ubuntu1.8+esm1"
          },
          {
            "binary_name": "spice-client",
            "binary_version": "0.12.4-0nocelt2ubuntu1.8+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "spice",
        "purl": "pkg:deb/ubuntu/spice@0.12.4-0nocelt2ubuntu1.8+esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.12.4-0nocelt1",
        "0.12.4-0nocelt1.1",
        "0.12.4-0nocelt1.1ubuntu1",
        "0.12.4-0nocelt2",
        "0.12.4-0nocelt2ubuntu1",
        "0.12.4-0nocelt2ubuntu1.1",
        "0.12.4-0nocelt2ubuntu1.2",
        "0.12.4-0nocelt2ubuntu1.3",
        "0.12.4-0nocelt2ubuntu1.4",
        "0.12.4-0nocelt2ubuntu1.5",
        "0.12.4-0nocelt2ubuntu1.6",
        "0.12.4-0nocelt2ubuntu1.7",
        "0.12.4-0nocelt2ubuntu1.8",
        "0.12.4-0nocelt2ubuntu1.8+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-server1",
            "binary_version": "0.12.6-4ubuntu0.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "spice",
        "purl": "pkg:deb/ubuntu/spice@0.12.6-4ubuntu0.5?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.12.5-1.1ubuntu2",
        "0.12.6-4",
        "0.12.6-4ubuntu0.1",
        "0.12.6-4ubuntu0.2",
        "0.12.6-4ubuntu0.3",
        "0.12.6-4ubuntu0.4",
        "0.12.6-4ubuntu0.5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-protocol-dev",
            "binary_version": "0.12.10-1ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "spice-protocol",
        "purl": "pkg:deb/ubuntu/spice-protocol@0.12.10-1ubuntu0.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.12.7-1",
        "0.12.10-1",
        "0.12.10-1ubuntu0.1",
        "0.12.10-1ubuntu0.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-spice-client-glib-2.0",
            "binary_version": "0.30-1"
          },
          {
            "binary_name": "gir1.2-spice-client-gtk-2.0",
            "binary_version": "0.30-1"
          },
          {
            "binary_name": "gir1.2-spice-client-gtk-3.0",
            "binary_version": "0.30-1"
          },
          {
            "binary_name": "libspice-client-glib-2.0-8",
            "binary_version": "0.30-1"
          },
          {
            "binary_name": "libspice-client-gtk-2.0-4",
            "binary_version": "0.30-1"
          },
          {
            "binary_name": "libspice-client-gtk-3.0-4",
            "binary_version": "0.30-1"
          },
          {
            "binary_name": "python-spice-client-gtk",
            "binary_version": "0.30-1"
          },
          {
            "binary_name": "spice-client-glib-usb-acl-helper",
            "binary_version": "0.30-1"
          },
          {
            "binary_name": "spice-client-gtk",
            "binary_version": "0.30-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "spice-gtk",
        "purl": "pkg:deb/ubuntu/spice-gtk@0.30-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.28-1ubuntu1",
        "0.29-1",
        "0.30-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-server1",
            "binary_version": "0.14.0-1ubuntu2.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "spice",
        "purl": "pkg:deb/ubuntu/spice@0.14.0-1ubuntu2.5?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.12.8-2.2",
        "0.14.0-1",
        "0.14.0-1ubuntu1",
        "0.14.0-1ubuntu2",
        "0.14.0-1ubuntu2.1",
        "0.14.0-1ubuntu2.2",
        "0.14.0-1ubuntu2.4",
        "0.14.0-1ubuntu2.5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-protocol-dev",
            "binary_version": "0.12.13-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "spice-protocol",
        "purl": "pkg:deb/ubuntu/spice-protocol@0.12.13-2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.12.13-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-spiceclientglib-2.0",
            "binary_version": "0.34-1.1build1"
          },
          {
            "binary_name": "gir1.2-spiceclientgtk-3.0",
            "binary_version": "0.34-1.1build1"
          },
          {
            "binary_name": "libspice-client-glib-2.0-8",
            "binary_version": "0.34-1.1build1"
          },
          {
            "binary_name": "libspice-client-gtk-3.0-5",
            "binary_version": "0.34-1.1build1"
          },
          {
            "binary_name": "spice-client-glib-usb-acl-helper",
            "binary_version": "0.34-1.1build1"
          },
          {
            "binary_name": "spice-client-gtk",
            "binary_version": "0.34-1.1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "spice-gtk",
        "purl": "pkg:deb/ubuntu/spice-gtk@0.34-1.1build1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.33-3.3",
        "0.34-1.1",
        "0.34-1.1build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-server1",
            "binary_version": "0.14.2-4ubuntu3.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "spice",
        "purl": "pkg:deb/ubuntu/spice@0.14.2-4ubuntu3.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.14.2-0ubuntu2",
        "0.14.2-4ubuntu1",
        "0.14.2-4ubuntu2",
        "0.14.2-4ubuntu3",
        "0.14.2-4ubuntu3.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-protocol-dev",
            "binary_version": "0.14.0-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "spice-protocol",
        "purl": "pkg:deb/ubuntu/spice-protocol@0.14.0-0ubuntu1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.14.0-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-spiceclientglib-2.0",
            "binary_version": "0.37-2fakesync1"
          },
          {
            "binary_name": "gir1.2-spiceclientgtk-3.0",
            "binary_version": "0.37-2fakesync1"
          },
          {
            "binary_name": "libspice-client-glib-2.0-8",
            "binary_version": "0.37-2fakesync1"
          },
          {
            "binary_name": "libspice-client-gtk-3.0-5",
            "binary_version": "0.37-2fakesync1"
          },
          {
            "binary_name": "spice-client-glib-usb-acl-helper",
            "binary_version": "0.37-2fakesync1"
          },
          {
            "binary_name": "spice-client-gtk",
            "binary_version": "0.37-2fakesync1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "spice-gtk",
        "purl": "pkg:deb/ubuntu/spice-gtk@0.37-2fakesync1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.37-0ubuntu1",
        "0.37-0ubuntu2",
        "0.37-2fakesync1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-server1",
            "binary_version": "0.15.0-2ubuntu4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "spice",
        "purl": "pkg:deb/ubuntu/spice@0.15.0-2ubuntu4?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.14.3-2.1ubuntu1",
        "0.15.0-2ubuntu1",
        "0.15.0-2ubuntu2",
        "0.15.0-2ubuntu3",
        "0.15.0-2ubuntu4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-spiceclientglib-2.0",
            "binary_version": "0.39-3ubuntu1"
          },
          {
            "binary_name": "gir1.2-spiceclientgtk-3.0",
            "binary_version": "0.39-3ubuntu1"
          },
          {
            "binary_name": "libspice-client-glib-2.0-8",
            "binary_version": "0.39-3ubuntu1"
          },
          {
            "binary_name": "libspice-client-gtk-3.0-5",
            "binary_version": "0.39-3ubuntu1"
          },
          {
            "binary_name": "spice-client-glib-usb-acl-helper",
            "binary_version": "0.39-3ubuntu1"
          },
          {
            "binary_name": "spice-client-gtk",
            "binary_version": "0.39-3ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "spice-gtk",
        "purl": "pkg:deb/ubuntu/spice-gtk@0.39-3ubuntu1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.39-1",
        "0.39-3",
        "0.39-3ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-protocol-dev",
            "binary_version": "0.14.3-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "spice-protocol",
        "purl": "pkg:deb/ubuntu/spice-protocol@0.14.3-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.14.3-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-server1",
            "binary_version": "0.15.1-1build2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "spice",
        "purl": "pkg:deb/ubuntu/spice@0.15.1-1build2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.15.1-1",
        "0.15.1-1build1",
        "0.15.1-1build2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-spiceclientglib-2.0",
            "binary_version": "0.42-2ubuntu2"
          },
          {
            "binary_name": "gir1.2-spiceclientgtk-3.0",
            "binary_version": "0.42-2ubuntu2"
          },
          {
            "binary_name": "libspice-client-glib-2.0-8",
            "binary_version": "0.42-2ubuntu2"
          },
          {
            "binary_name": "libspice-client-gtk-3.0-5",
            "binary_version": "0.42-2ubuntu2"
          },
          {
            "binary_name": "spice-client-glib-usb-acl-helper",
            "binary_version": "0.42-2ubuntu2"
          },
          {
            "binary_name": "spice-client-gtk",
            "binary_version": "0.42-2ubuntu2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "spice-gtk",
        "purl": "pkg:deb/ubuntu/spice-gtk@0.42-2ubuntu2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.42-2",
        "0.42-2ubuntu1",
        "0.42-2ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-protocol-dev",
            "binary_version": "0.14.3-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "spice-protocol",
        "purl": "pkg:deb/ubuntu/spice-protocol@0.14.3-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.14.3-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-server1",
            "binary_version": "0.16.0-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "spice",
        "purl": "pkg:deb/ubuntu/spice@0.16.0-3?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.16.0-1",
        "0.16.0-2",
        "0.16.0-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-spiceclientglib-2.0",
            "binary_version": "0.42-4build2"
          },
          {
            "binary_name": "gir1.2-spiceclientgtk-3.0",
            "binary_version": "0.42-4build2"
          },
          {
            "binary_name": "libspice-client-glib-2.0-8",
            "binary_version": "0.42-4build2"
          },
          {
            "binary_name": "libspice-client-gtk-3.0-5",
            "binary_version": "0.42-4build2"
          },
          {
            "binary_name": "spice-client-glib-usb-acl-helper",
            "binary_version": "0.42-4build2"
          },
          {
            "binary_name": "spice-client-gtk",
            "binary_version": "0.42-4build2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "spice-gtk",
        "purl": "pkg:deb/ubuntu/spice-gtk@0.42-4build2?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.42-4build1",
        "0.42-4build2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-protocol-dev",
            "binary_version": "0.14.5-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "spice-protocol",
        "purl": "pkg:deb/ubuntu/spice-protocol@0.14.5-1build1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.14.5-1build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-server1",
            "binary_version": "0.16.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "spice",
        "purl": "pkg:deb/ubuntu/spice@0.16.0-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.15.2-1",
        "0.16.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "gir1.2-spiceclientglib-2.0",
            "binary_version": "0.42-4build1"
          },
          {
            "binary_name": "gir1.2-spiceclientgtk-3.0",
            "binary_version": "0.42-4build1"
          },
          {
            "binary_name": "libspice-client-glib-2.0-8",
            "binary_version": "0.42-4build1"
          },
          {
            "binary_name": "libspice-client-gtk-3.0-5",
            "binary_version": "0.42-4build1"
          },
          {
            "binary_name": "spice-client-glib-usb-acl-helper",
            "binary_version": "0.42-4build1"
          },
          {
            "binary_name": "spice-client-gtk",
            "binary_version": "0.42-4build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "spice-gtk",
        "purl": "pkg:deb/ubuntu/spice-gtk@0.42-4build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.42-4",
        "0.42-4build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libspice-protocol-dev",
            "binary_version": "0.14.5-1build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "spice-protocol",
        "purl": "pkg:deb/ubuntu/spice-protocol@0.14.5-1build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.14.3-1",
        "0.14.5-1",
        "0.14.5-1build1"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.",
  "id": "UBUNTU-CVE-2026-105959",
  "modified": "2026-10-28T17:50:30Z",
  "published": "2026-10-16T12:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-105959"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105959"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554008"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.freedesktop.org/spice/spice/-/merge_requests/253"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.freedesktop.org/spice/spice/-/commit/a3b9feb121fa6b19dc55cca6ec546e35fe4c9573"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.freedesktop.org/spice/spice/-/commit/4807b923d09e656d3f414ccde16d83189ba79ac9"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-105959"
  ]
}

CVE-2026-105959 (GCVE-0-2026-105959)

Vulnerability from cvelistv5 – Published: 2026-10-16 11:53 – Updated: 2026-10-20 20:43

Title

Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 14:04 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1076 records in the last 180 days details

References

3 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-105959	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2554008	issue-trackingx_refsource_REDHAT
https://gitlab.freedesktop.org/spice/spice/-/merg…

Impacted products

3 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8

Date Public

2026-10-08 11:00

Credits

Upstream acknowledges Tristan Madani (Talence Security) as the original reporter.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105959",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:04:30.322816Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T14:04:46.377Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "spice-server",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "spice",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "spice",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Upstream acknowledges Tristan Madani (Talence Security) as the original reporter."
        }
      ],
      "datePublic": "2026-10-08T11:00:52.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T20:43:08.849Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-105959"
        },
        {
          "name": "RHBZ#2554008",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554008"
        },
        {
          "url": "https://gitlab.freedesktop.org/spice/spice/-/merge_requests/253"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-08T11:00:52.000Z",
          "value": "Made public."
        }
      ],
      "title": "Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation",
      "workarounds": [
        {
          "lang": "en",
          "value": "This vulnerability is only exploitable during VM live migration by an authenticated SPICE client. If live migration is not required, disabling it eliminates the attack surface. If live migration is needed, restrict SPICE client connections to trusted networks using firewall rules and enforce strong authentication (TLS with mutual certificate validation, or SASL with strong credentials) to limit who can connect as a SPICE client.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent integer truncation of size_t allocation calculations to int when invoking the GlzEncoderUsrContext::malloc callback in the GLZ dictionary restore path: upgrade to the fixed Spice/Spice Server builds, which prevent truncation of size_t allocation sizes to int when invoking the GLZ dictionary malloc callback, closing all 2 injection vectors (crafted SPICE_MSGC_MIGRATE_DATA message, malicious max_encoders field in GlzEncDictRestoreData). Until patched, this is a concern on 64-bit Linux hosts running SPICE server, so Disable VM live migration if not required, restrict SPICE client access to trusted networks using firewall rules, and enforce strong authentication via SASL or TLS with mutual certificate validation. As a compensating measure, Run SELinux in enforcing mode to confine the SPICE server process domain and restrict unauthorized system access if the heap overflow is exploited. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer truncation defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-105959",
    "datePublished": "2026-10-16T11:53:00.840Z",
    "dateReserved": "2026-10-06T08:37:18.542Z",
    "dateUpdated": "2026-10-20T20:43:08.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted