Live › vulnerability › CVE-2026-105959
Go to dashboardspice-server truncates a size_t allocation size to int in the GLZ encoder dictionary restore path, so a crafted max_encoders value in VM live migration data can cause a large heap buffer overflow. An attacker with an authenticated SPICE client connection during live migration could corrupt heap memory on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running QEMU/KVM guests with a SPICE display that live-migrate VMs to or from them. An authenticated SPICE client could send a crafted max_encoders value in the migration data and overflow the heap of the host process. Hosts with no SPICE displays (VNC only) or with live migration disabled can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| spice-server | vendor | all versions (no fixed version published) | – |
spice-server package check (rpm -q spice-server or dpkg -l libspice-server1)spice" or a -spice option on the qemu command line) and whether live migration is usedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
This page as .md · .json · in your agent: get_signal("CVE-2026-105959")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.