CVE-2026-105959
Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
- Record
CVE-2026-105959- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-04
EUVDEUVD-2026-102846
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
- Record
EUVD-2026-102846- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-m5f2-676c-jfj7
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t...
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
- Record
GHSA-m5f2-676c-jfj7- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
- Record
CVE-2026-105959- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-04
OSVBELL-CVE-2026-105959
- Record
BELL-CVE-2026-105959- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-105959
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
- Record
DEBIAN-CVE-2026-105959- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-105959
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
- Record
UBUNTU-CVE-2026-105959- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12222-1 No score
libspice-server-devel-0.16.0-3.1 on GA media
These are all security issues fixed in the libspice-server-devel-0.16.0-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12222-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spiceAlpaquita:23 |
0.15.1-r0 and later | None known |
spiceAlpaquita:25 |
0.15.2-r1 and later | None known |
spiceAlpaquita:stream |
0.15.0-r2 and later | None known |
spiceDebian:12 |
All versions, plus listed versions 0.15.1-10.15.2-10.16.0-10.16.0-20.16.0-3 |
None known |
spiceDebian:13 |
All versions, plus listed versions 0.15.2-10.16.0-10.16.0-20.16.0-3 |
None known |
spiceDebian:14 |
All versions, plus listed versions 0.15.2-10.16.0-10.16.0-20.16.0-3 |
None known |
spiceUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.12.4-0nocelt10.12.4-0nocelt1.10.12.4-0nocelt1.1ubuntu10.12.4-0nocelt20.12.4-0nocelt2ubuntu1 Show 9 moreShow less0.12.4-0nocelt2ubuntu1.10.12.4-0nocelt2ubuntu1.20.12.4-0nocelt2ubuntu1.30.12.4-0nocelt2ubuntu1.40.12.4-0nocelt2ubuntu1.50.12.4-0nocelt2ubuntu1.60.12.4-0nocelt2ubuntu1.70.12.4-0nocelt2ubuntu1.80.12.4-0nocelt2ubuntu1.8+esm1 |
None known |
spiceUbuntu:16.04:LTS |
All versions, plus listed versions 0.12.5-1.1ubuntu20.12.6-40.12.6-4ubuntu0.10.12.6-4ubuntu0.20.12.6-4ubuntu0.30.12.6-4ubuntu0.40.12.6-4ubuntu0.5 |
None known |
spice-protocolUbuntu:16.04:LTS |
All versions, plus listed versions 0.12.7-10.12.10-10.12.10-1ubuntu0.10.12.10-1ubuntu0.2 |
None known |
spice-gtkUbuntu:16.04:LTS |
All versions, plus listed versions 0.28-1ubuntu10.29-10.30-1 |
None known |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
spiceUbuntu:18.04:LTS |
All versions, plus listed versions 0.12.8-2.20.14.0-10.14.0-1ubuntu10.14.0-1ubuntu20.14.0-1ubuntu2.10.14.0-1ubuntu2.20.14.0-1ubuntu2.40.14.0-1ubuntu2.5 |
None known |
spice-protocolUbuntu:18.04:LTS |
All versions, plus listed versions 0.12.13-2 |
None known |
spice-gtkUbuntu:18.04:LTS |
All versions, plus listed versions 0.33-3.30.34-1.10.34-1.1build1 |
None known |
spiceUbuntu:20.04:LTS |
All versions, plus listed versions 0.14.2-0ubuntu20.14.2-4ubuntu10.14.2-4ubuntu20.14.2-4ubuntu30.14.2-4ubuntu3.1 |
None known |
spice-protocolUbuntu:20.04:LTS |
All versions, plus listed versions 0.14.0-0ubuntu1 |
None known |
spice-gtkUbuntu:20.04:LTS |
All versions, plus listed versions 0.37-0ubuntu10.37-0ubuntu20.37-2fakesync1 |
None known |
spiceUbuntu:22.04:LTS |
All versions, plus listed versions 0.14.3-2.1ubuntu10.15.0-2ubuntu10.15.0-2ubuntu20.15.0-2ubuntu30.15.0-2ubuntu4 |
None known |
spice-gtkUbuntu:22.04:LTS |
All versions, plus listed versions 0.39-10.39-30.39-3ubuntu1 |
None known |
spice-protocolUbuntu:22.04:LTS |
All versions, plus listed versions 0.14.3-1 |
None known |
spiceUbuntu:24.04:LTS |
All versions, plus listed versions 0.15.1-10.15.1-1build10.15.1-1build2 |
None known |
spice-gtkUbuntu:24.04:LTS |
All versions, plus listed versions 0.42-20.42-2ubuntu10.42-2ubuntu2 |
None known |
spice-protocolUbuntu:24.04:LTS |
All versions, plus listed versions 0.14.3-1 |
None known |
spiceUbuntu:26.10 |
All versions, plus listed versions 0.16.0-10.16.0-20.16.0-3 |
None known |
spice-gtkUbuntu:26.10 |
All versions, plus listed versions 0.42-4build10.42-4build2 |
None known |
spice-protocolUbuntu:26.10 |
All versions, plus listed versions 0.14.5-1build1 |
None known |
spiceUbuntu:26.04:LTS |
All versions, plus listed versions 0.15.2-10.16.0-1 |
None known |
spice-gtkUbuntu:26.04:LTS |
All versions, plus listed versions 0.42-40.42-4build1 |
None known |
spice-protocolUbuntu:26.04:LTS |
All versions, plus listed versions 0.14.3-10.14.5-10.14.5-1build1 |
None known |
spiceopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.16.0-3.1 | 0.16.0-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | EUVD, NVD, OSV | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-105959 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 6, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. No source names a fixed version.
References
access.redhat.com/security/cve/CVE-2026-105959
bugzilla.redhat.com/show_bug.cgi?id=2554008
gitlab.freedesktop.org/spice/spice/-/merge_requests/253
nvd.nist.gov/vuln/detail/CVE-2026-105959
github.com/advisories/GHSA-m5f2-676c-jfj7
docs.bell-sw.com/security/cves/CVE-2026-105959
Show 7 moreShow less
security-tracker.debian.org/tracker/CVE-2026-105959
ubuntu.com/security/CVE-2026-105959
cve.org/CVERecord?id=CVE-2026-105959
suse.com/security/cve/CVE-2026-105958