CVE-2026-105958
Spice-server: spice: heap oob read/write via unchecked migration data offsets
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Spice-server: spice: heap oob read/write via unchecked migration data offsets
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
- Record
CVE-2026-105958- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-04
EUVDEUVD-2026-102856
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
- Record
EUVD-2026-102856- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-q367-g3jh-xmfv
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets...
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
- Record
GHSA-q367-g3jh-xmfv- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
- Record
CVE-2026-105958- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-04
OSVBELL-CVE-2026-105958
- Record
BELL-CVE-2026-105958- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-105958
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
- Record
DEBIAN-CVE-2026-105958- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-105958
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
- Record
UBUNTU-CVE-2026-105958- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12222-1 No score
libspice-server-devel-0.16.0-3.1 on GA media
These are all security issues fixed in the libspice-server-devel-0.16.0-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12222-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spiceAlpaquita:23 |
0.15.1-r0 and later | None known |
spiceAlpaquita:25 |
0.15.2-r1 and later | None known |
spiceAlpaquita:stream |
0.15.0-r2 and later | None known |
spiceDebian:12 |
All versions, plus listed versions 0.15.1-10.15.2-10.16.0-10.16.0-20.16.0-3 |
None known |
spiceDebian:13 |
All versions, plus listed versions 0.15.2-10.16.0-10.16.0-20.16.0-3 |
None known |
spiceDebian:14 |
All versions, plus listed versions 0.15.2-10.16.0-10.16.0-20.16.0-3 |
None known |
spiceUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.12.4-0nocelt10.12.4-0nocelt1.10.12.4-0nocelt1.1ubuntu10.12.4-0nocelt20.12.4-0nocelt2ubuntu1 Show 9 moreShow less0.12.4-0nocelt2ubuntu1.10.12.4-0nocelt2ubuntu1.20.12.4-0nocelt2ubuntu1.30.12.4-0nocelt2ubuntu1.40.12.4-0nocelt2ubuntu1.50.12.4-0nocelt2ubuntu1.60.12.4-0nocelt2ubuntu1.70.12.4-0nocelt2ubuntu1.80.12.4-0nocelt2ubuntu1.8+esm1 |
None known |
spiceUbuntu:16.04:LTS |
All versions, plus listed versions 0.12.5-1.1ubuntu20.12.6-40.12.6-4ubuntu0.10.12.6-4ubuntu0.20.12.6-4ubuntu0.30.12.6-4ubuntu0.40.12.6-4ubuntu0.5 |
None known |
spice-protocolUbuntu:16.04:LTS |
All versions, plus listed versions 0.12.7-10.12.10-10.12.10-1ubuntu0.10.12.10-1ubuntu0.2 |
None known |
spice-gtkUbuntu:16.04:LTS |
All versions, plus listed versions 0.28-1ubuntu10.29-10.30-1 |
None known |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
spiceUbuntu:18.04:LTS |
All versions, plus listed versions 0.12.8-2.20.14.0-10.14.0-1ubuntu10.14.0-1ubuntu20.14.0-1ubuntu2.10.14.0-1ubuntu2.20.14.0-1ubuntu2.40.14.0-1ubuntu2.5 |
None known |
spice-protocolUbuntu:18.04:LTS |
All versions, plus listed versions 0.12.13-2 |
None known |
spice-gtkUbuntu:18.04:LTS |
All versions, plus listed versions 0.33-3.30.34-1.10.34-1.1build1 |
None known |
spiceUbuntu:20.04:LTS |
All versions, plus listed versions 0.14.2-0ubuntu20.14.2-4ubuntu10.14.2-4ubuntu20.14.2-4ubuntu30.14.2-4ubuntu3.1 |
None known |
spice-protocolUbuntu:20.04:LTS |
All versions, plus listed versions 0.14.0-0ubuntu1 |
None known |
spice-gtkUbuntu:20.04:LTS |
All versions, plus listed versions 0.37-0ubuntu10.37-0ubuntu20.37-2fakesync1 |
None known |
spiceUbuntu:22.04:LTS |
All versions, plus listed versions 0.14.3-2.1ubuntu10.15.0-2ubuntu10.15.0-2ubuntu20.15.0-2ubuntu30.15.0-2ubuntu4 |
None known |
spice-gtkUbuntu:22.04:LTS |
All versions, plus listed versions 0.39-10.39-30.39-3ubuntu1 |
None known |
spice-protocolUbuntu:22.04:LTS |
All versions, plus listed versions 0.14.3-1 |
None known |
spiceUbuntu:24.04:LTS |
All versions, plus listed versions 0.15.1-10.15.1-1build10.15.1-1build2 |
None known |
spice-gtkUbuntu:24.04:LTS |
All versions, plus listed versions 0.42-20.42-2ubuntu10.42-2ubuntu2 |
None known |
spice-protocolUbuntu:24.04:LTS |
All versions, plus listed versions 0.14.3-1 |
None known |
spiceUbuntu:26.10 |
All versions, plus listed versions 0.16.0-10.16.0-20.16.0-3 |
None known |
spice-gtkUbuntu:26.10 |
All versions, plus listed versions 0.42-4build10.42-4build2 |
None known |
spice-protocolUbuntu:26.10 |
All versions, plus listed versions 0.14.5-1build1 |
None known |
spiceUbuntu:26.04:LTS |
All versions, plus listed versions 0.15.2-10.16.0-1 |
None known |
spice-gtkUbuntu:26.04:LTS |
All versions, plus listed versions 0.42-40.42-4build1 |
None known |
spice-protocolUbuntu:26.04:LTS |
All versions, plus listed versions 0.14.3-10.14.5-10.14.5-1build1 |
None known |
spiceopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.16.0-3.1 | 0.16.0-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | EUVD, NVD, OSV | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-105958 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 6, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 15th percentile. No source names a fixed version.