CVE-2026-105958
Received Received - Intake

Heap Corruption in SPICE Server via Migration Data

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: redhat-SADP

Description
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-105958
EUVD
EUVD-2026-102856

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 6 *
Red Hat Red Hat Enterprise Linux 7 *
Red Hat Red Hat Enterprise Linux 8 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the spice-server component where migration data handlers do not validate client-supplied offsets in SPICE_MSGC_MIGRATE_DATA messages. A malicious authenticated SPICE client can exploit this during VM live migration to read arbitrary heap memory or cause heap corruption through out-of-bounds read and write operations.

Detection Guidance

Detection involves monitoring SPICE server logs for unusual migration-related errors or crashes during live migration. Check for out-of-bounds memory access warnings or heap corruption messages in logs. No specific commands are provided in the resources, but inspecting spice-server logs and network traffic during migration attempts may reveal anomalies.

Impact Analysis

An attacker could exploit this to read sensitive data from memory, modify memory contents, or crash the system, leading to potential data breaches, unauthorized code execution, or denial-of-service during live VM migration.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations if exploited, resulting in legal penalties or reputational damage.

Mitigation Strategies

Disable live migration if not required. Restrict SPICE client connections to trusted networks using firewall rules. Enforce strong authentication with TLS mutual certificate validation or SASL with strong credentials. Monitor for suspicious activity during migration attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105958. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart