Live › vulnerability › CVE-2026-105958
Go to dashboardDuring VM live migration, spice-server trusts offsets sent by a SPICE client in SPICE_MSGC_MIGRATE_DATA messages without checking bounds. A malicious authenticated client can read arbitrary heap memory or corrupt the heap through out-of-bounds reads and writes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running QEMU/libvirt VMs with SPICE displays (RHEL 6/7/8, Debian, Alpaquita and similar) that perform live migration while SPICE clients are connected. An attacker needs an authenticated SPICE client connection and must act during migration. Systems that do not use SPICE or never live-migrate can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| spice-server | vendor | all versions (no fixed version published) | – |
spice")Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
This page as .md · .json · in your agent: get_signal("CVE-2026-105958")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.