CVE-2026-105959
Received Received - Intake

Heap Buffer Overflow in SPICE Server During VM Live Migration

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: redhat-SADP

Description
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-105959
EUVD
EUVD-2026-102846

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 6 *
Red Hat Red Hat Enterprise Linux 7 *
Red Hat Red Hat Enterprise Linux 8 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-105959 is a heap buffer overflow in the SPICE server caused by integer truncation during GLZ dictionary restoration. A malicious authenticated SPICE client can exploit this by sending a crafted max_encoders value during VM live migration, causing a size_t allocation size to be truncated to int. This leads to a massive heap overflow when the system writes data beyond the allocated buffer.

Detection Guidance

Detecting this vulnerability requires monitoring SPICE server logs during VM live migration for abnormal memory allocation errors or crashes. Check for heap corruption messages in system logs like /var/log/messages or journalctl. Inspect network traffic for malformed SPICE_MSGC_MIGRATE_DATA messages with unusually large max_encoders values.

Impact Analysis

This vulnerability can cause crashes, memory corruption, or unauthorized code execution on systems running affected SPICE server versions. Exploitation requires an authenticated SPICE client and an active live migration window, allowing attackers to compromise the host system or other VMs.

Compliance Impact

This vulnerability could lead to unauthorized code execution, memory corruption, or crashes, which may result in data breaches or loss of sensitive information. For GDPR, this could violate principles of data protection and confidentiality, potentially leading to regulatory penalties. For HIPAA, it may compromise the integrity and availability of protected health information, risking compliance with security requirements.

Mitigation Strategies

Disable live migration if not required. Restrict SPICE client access to trusted networks using firewall rules. Enforce strong authentication with TLS mutual certificates or SASL with strong credentials. Monitor for suspicious client behavior during migration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105959. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart