EUVD-2026-102856

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-105958 Spice-server: spice: heap oob read/write via unchecked migration data offsets

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-105958

A flaw in spice-server allows an authenticated SPICE client to perform out-of-bounds read and write operations during VM live migration. The vulnerability exists because multiple migration data handlers fail to perform bounds validation on client-supplied offsets from SPICE_MSGC_MIGRATE_DATA mess...

CVE-2026-105958 Spice-server: spice: heap oob read/write via unchecked migration data offsets

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-105958

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-105959

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

CVE-2026-105959 Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

CVE-2026-105959

A flaw in spice-server allows an authenticated SPICE client to trigger a massive heap buffer overflow during a VM live migration. The root cause is an integer truncation where a size_t allocation size is truncated to int when calling the malloc callback during the GLZ encoder dictionary restore p...

CVE-2026-105959 Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

EUVD-2026-102846

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

CVE-2026-105959

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

PT-2026-115581

Name of the Vulnerable Software and Affected Versions spice-server affected versions not specified Description A flaw exists in the GLZ encoder dictionary restore path where a size t allocation size is truncated to an int during a malloc callback. An authenticated SPICE client can exploit this...

Red Hat: CVE-2026-105958: spice-server vulnerability

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

Red Hat: CVE-2026-105959: spice-server: spice: Heap buffer overflow via GLZ dictionary max_encoders integer truncation

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

Linux Distros Unpatched Vulnerability : CVE-2026-105958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation,...

PT-2026-115586

Name of the Vulnerable Software and Affected Versions spice-server affected versions not specified Description Multiple migration data handlers fail to perform bounds validation on client-supplied offsets within SPICE MSGC MIGRATE DATA messages. This allows an authenticated SPICE client to perfor...

Linux Distros Unpatched Vulnerability : CVE-2026-105959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: x86 – Mark the target gfn of the emulated atomic instruction as dirty When emulating an atomic access on behalf of the guest, mark the target gfn as dirty if the CMPXCHG instruction attempts to be executed and fails without ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: x86/sev: Make encdechypercall accept a size instead of npages. encdechypercall previously accepted the number of pages instead of their size, forcing its callers to round up values. As a result, non-page-aligned vaddrs operations...

SUSE CVE-2026-89908

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Preserve memslot arch flags on KVMMRFLAGSONLY kvmarchpreparememoryregion computes new-arch.flags, i.e. whether a memslot is KVMMEMHUGEPAGECAPABLE or KVMMEMHUGEPAGEINCAPABLE, only for KVMMRCREATE and KVMMRMOVE, and...