Red Hat spice-server: Heap buffer overflow via GLZ dictionary integer truncation
Summary
A flaw in the GLZ dictionary restore path of spice-server truncates a size_t allocation size to int during VM live migration. An authenticated SPICE client can send crafted migration data with a manipulated max_encoders value to trigger a heap buffer overflow. Successful exploitation requires valid SPICE client credentials and an active live migration, and can lead to a crash or code execution in the SPICE server process.
Affected
- Red Hat Enterprise Linux 6, 7 and 8 (default status: affected, per CVE record)
- Exact fixed-affected package versions: Unknown.
- Upstream spice-server versions: Unknown.
Fixed in
- Upstream fix: GitLab merge request 253 (commits a3b9feb121fa6b19dc55cca6ec546e35fe4c9573 and 4807b923d09e656d3f414ccde16d83189ba79ac9).
- Vendor fixed package versions: Unknown. Check the Red Hat advisory and your distribution's errata.
Workaround
- Disable VM live migration if it is not required.
- If live migration is required, restrict SPICE client access to trusted networks using firewall rules.
- Enforce strong authentication for SPICE clients (TLS with mutual certificate validation or SASL with strong credentials).
- Run SELinux in enforcing mode to confine the SPICE server process (compensating measure only).
- These measures reduce exposure but do not fix the underlying defect.
Exploitation
- No known exploitation in the wild.
- Not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public exploit reported by VulDB or PSIRT.
- EPSS 0.00404 (very low 30-day exploitation probability).
Our recommendation
- Check whether your hypervisors use SPICE and VM live migration.
- If not, no action needed beyond verifying that SPICE is disabled.
- Apply vendor updates as soon as they are available for your distribution.
- Until patched, disable live migration where not needed and restrict SPICE and migration access to trusted networks.
- Enforce SELinux in enforcing mode on KVM hosts.
- Patch sibling issue CVE-2026-105958 together with this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-105959 access.redhat.com
- Red Hat Bugzilla 2554008 bugzilla.redhat.com
- Upstream GitLab merge request 253 gitlab.freedesktop.org
- Ubuntu security CVE-2026-105959 ubuntu.com
- Amazon Linux ALAS2-2026-4030 vulners.com
- SUSE CVE entry SUSECVE-2026-105959 vulners.com
- Sibling CVE-2026-105958 (Strix) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 15:43.
Original description (NVD)
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.