{"id":"CVE-2026-105959","kind":"vulnerability","aliases":["CVE-2026-105959"],"related":[],"title":"spice-server: integer truncation in GLZ restore enables heap overflow during migration","description":"A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.","summary":"spice-server truncates a size_t allocation size to int in the GLZ encoder dictionary restore path, so a crafted max_encoders value in VM live migration data can cause a large heap buffer overflow. An attacker with an authenticated SPICE client connection during live migration could corrupt heap memory on the host.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"spice-server","fixed":[],"affected":"all versions (no fixed version published)","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","kvm","live-migration","other","qemu","spice-server","virtualization"],"not_affected_if":["no-live-migration","no-spice-display"],"how_to_check":"Run 'spice-server' package check (rpm -q spice-server or dpkg -l libspice-server1). Any version is currently treated as affected. Then check whether guests use SPICE graphics (virsh dumpxml <vm> | grep -i \"graphics type='spice'\" or a -spice option on the qemu command line) and whether live migration is used. You are exposed only if both are true.","fix":"No fixed spice-server release as of 2026-10-25 (Debian: unfixed; Tenable: no vendor patch). Watch Debian bug 1151202 and the Red Hat CVE page. Until then, reduce exposure as described under mitigation.","status":"open","published_at":"2026-10-16T12:16:31+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:25:09+00:00","updated_at":"2026-10-25T03:47:50+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:25:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"spice-server: integer truncation in GLZ restore enables heap overflow during migration","impact":"high","summary":"spice-server truncates a size_t allocation size to int in the GLZ encoder dictionary restore path, so a crafted max_encoders value in VM live migration data can cause a large heap buffer overflow. An attacker with an authenticated SPICE client connection during live migration could corrupt heap memory on the host.","category":"other","nicknames":[],"who_cares":["spice-server","qemu","kvm","virtualization"],"confidence":0.5,"needs_auth":"yes","worst_case":"heap overflow in host process may allow code execution","analyst_note":"Find affected and fixed spice-server versions and any upstream patch or advisory from the NVD entry; the sources give no version or fix details.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-spice-display","no-live-migration"],"who_is_affected":"Hosts running spice-server (the SPICE display server used with QEMU/KVM virtual machines) that accept SPICE client connections and perform VM live migration. The sources do not name affected versions. Teams without SPICE-based virtualization can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000561,"input_tokens":3295,"output_tokens":463,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed spice-server versions and any upstream patch or advisory from the NVD entry; the sources give no version or fix details.","search":"'-105959':16A,19A '-2026':15A,18A 'alloc':43B,108C 'allow':117C 'attack':73B 'auth':24B 'auth-requir':23B 'authent':76B,120C 'buffer':70B,132C 'call':113C 'callback':116C 'caus':66B 'client':78B,122C 'connect':79B 'corrupt':84B 'could':83B 'craft':56B,137C 'cve':14A,17A 'data':64B,143C 'dictionari':51B,101C 'enabl':9A 'encod':50B,58B,100C,139C 'flaw':91C 'found':93C 'glz':7A,49B,99C 'heap':10A,69B,85B,131C 'host':89B 'int':46B,111C 'integ':4A 'kvm':26B 'larg':68B 'live':28B,62B,81B,125C 'live-migr':27B 'malici':119C 'malloc':115C 'massiv':130C 'max':57B,138C 'memori':86B 'migrat':13A,29B,63B,82B,126C,142C 'overflow':11A,71B,133C 'path':53B,103C 'qemu':31B 'requir':25B 'restor':8A,52B,102C 'send':135C 'server':3A,22A,34B,38B,97C 'size':41B,44B,106C,109C 'spice':2A,21A,33B,37B,77B,96C,121C 'spice-serv':1A,32B,36B,95C 'spice-server':20A 'trigger':128C 'truncat':5A,39B,104C 'valu':59B,140C 'virtual':35B 'vm':61B,124C","nicknames":[],"mitigations":[],"who_affected":"Hosts running QEMU/KVM guests with a SPICE display that live-migrate VMs to or from them. An authenticated SPICE client could send a crafted max_encoders value in the migration data and overflow the heap of the host process. Hosts with no SPICE displays (VNC only) or with live migration disabled can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T12:16:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105959","severity":null,"published_at":"2026-10-16T12:16:31+00:00","modified_at":"2026-10-16T19:23:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105959:794","url":null,"severity":null,"published_at":"2026-10-25T03:47:50+00:00","modified_at":"2026-10-25T03:47:50+00:00","first_seen_at":"2026-10-25T03:47:50+00:00","fetched_at":"2026-10-25T03:47:50+00:00","note":"Red Hat CVE page and Debian tracker (Debian bug 1151202) read: no upstream fix or fixed version as of 2026-10-25; Debian lists 0.15.1, 0.15.2 and 0.16.0 as vulnerable and unfixed; CVE record says all versions affected. No PoC or exploitation found. Red Hat's mitigation text is labelled AI-generated, so I did not mark anything verified."}],"documents":[{"id":3344,"url":"https://access.redhat.com/security/cve/cve-2026-105959","title":"Red Hat CVE-2026-105959","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3345,"url":"https://security-tracker.debian.org/tracker/CVE-2026-105959","title":"Debian tracker CVE-2026-105959","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}