{"id":"CVE-2026-57965","aliases":["CLSA-2026-1786717202","CLSA-2026-1788381510","DEBIAN-CVE-2026-57965","EUVD-2026-40049","GHSA-54pp-f5wh-29jc","MGASA-2026-0384","OESA-2026-3190","SUSE-SU-2026:23109-1","SUSE-SU-2026:3470-1","SUSE-SU-2026:3485-1","SUSE-SU-2026:3585-1","UBUNTU-CVE-2026-57965","USN-8723-1","openSUSE-SU-2026:11379-1","openSUSE-SU-2026:21506-1"],"status":"published","title":"Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow","description":"A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.","severity":{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00113,"percentile":0.01447,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-06-29T07:53:39Z","modified":"2026-11-06T10:04:48Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"spice-vdagent","fixed_in":["0.21.0-5.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"spice-vdagent","fixed_in":["0.21.0-5.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"spice-vdagent","fixed_in":["0.22.1-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"spice-vdagent","fixed_in":["0.23.0-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"spice-vdagent","fixed_in":["0.22.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"spice-vdagent","fixed_in":["0.22.1-4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"spice-vdagent","fixed_in":["0.23.0-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-5.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-5.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-3+deb12u1"}]}],"versions":["0.22.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.1-4.1","0.22.1-4.1+deb13u1","0.22.1-5","0.23.0-1","0.23.0-2","0.23.0-3","0.23.0-4"]},{"source":"osv","ecosystem":"Debian:14","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-3"}]}],"versions":["0.22.1-4.1","0.22.1-5","0.23.0-1","0.23.0-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-1.1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-2.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-3.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-3.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-3.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-3.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-4.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-150300.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-150300.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-150300.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-150300.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-150500.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-150500.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-150500.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-150500.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-150500.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-150500.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-150500.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-8.13.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-8.13.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-8.13.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.15.0-1.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.17.0-1ubuntu1","0.17.0-1ubuntu2","0.17.0-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-2","0.19.0-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-1ubuntu0.1"}]}],"versions":["0.20.0-2build1","0.20.0-3","0.22.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-4ubuntu0.1"}]}],"versions":["0.22.1-3","0.22.1-4","0.22.1-4build1","0.22.1-4build2","0.22.1-4build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.1-4.1","0.22.1-4.1ubuntu1","0.22.1-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-1ubuntu0.1"}]}],"versions":["0.22.1-5","0.23.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-1ubuntu0.1"}]}],"versions":["0.20.0-2build1","0.20.0-3","0.22.1-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-4ubuntu0.1"}]}],"versions":["0.22.1-3","0.22.1-4","0.22.1-4build1","0.22.1-4build2","0.22.1-4build3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-1ubuntu0.1"}]}],"versions":["0.22.1-5","0.23.0-1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"spice-vdagent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"spice-space","product":"spice-vdagent"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-57965","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493581","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57965","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-54pp-f5wh-29jc"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1786717202.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788381510.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57966","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-57965","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0384.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36257","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8723-1","tags":["advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/07/msg00040.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3190","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623109-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269553","tags":["report"]},{"url":"https://bugzilla.suse.com/1269554","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57966","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263470-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263485-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263585-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189821","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57965","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57966","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-57965","title":"Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow","description":"A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.","status":"published","published":"2026-06-29T07:53:39.079Z","modified":"2026-11-05T22:16:53.039Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-05T23:55:29.66083Z"}],"euvd":[{"id":"EUVD-2026-40049","description":"A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.","status":"published","published":"2026-06-29T07:53:39Z","modified":"2026-11-05T22:16:53Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-05T23:02:19.769742Z"}],"ghsa":[{"id":"GHSA-54pp-f5wh-29jc","title":"A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer...","description":"A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.","status":"published","published":"2026-06-29T09:30:29Z","modified":"2026-06-29T09:30:37Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:09:03.268343Z"}],"nvd":[{"id":"CVE-2026-57965","description":"A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.","status":"published","published":"2026-06-29T09:16:31.283Z","modified":"2026-11-05T23:16:50.8Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-06T01:57:38.912201Z"}],"osv":[{"id":"DEBIAN-CVE-2026-57965","description":"A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.","status":"published","published":"2026-06-29T09:16:31.283Z","modified":"2026-11-06T10:04:48.468056069Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"OESA-2026-3190","title":"spice-vdagent security update","description":"is an optional component for enhancing user experience and performing guest-oriented management tasks.  Its features includes: client mouse mode (no need to grab mouse by client, no mouse lag), automatic adjustment  of screen resolution, copy and paste (text and image) between client and domU. It also requires vdagent service  installed on domU o.s. to work. The default is 0.    %package_help\r\n\r\nSecurity Fix(es):\n\nA flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.(CVE-2026-57965)\n\nA path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be untrusted or compromised for exploitation.(CVE-2026-57966)","status":"published","published":"2026-08-01T11:12:04Z","modified":"2026-08-18T01:21:24.84501384Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-57965","description":"A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.","status":"published","published":"2026-06-29T09:16:00Z","modified":"2026-09-03T22:52:55.247083361Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1786717202","title":"spice-vdagent: Fix of CVE-2026-57965","description":"- Fix CVE-2026-57965 - integer overflow in udscs_write buffer size calculation","status":"published","published":"2026-08-14T14:20:14Z","modified":"2026-10-26T09:31:04.12945515Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1788381510","title":"spice-vdagent: Fix of 2 CVEs","description":"- Fix CVE-2026-57965 - integer overflow in udscs_write buffer size calculation","status":"published","published":"2026-09-02T22:53:13Z","modified":"2026-10-26T09:30:33.191095974Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"MGASA-2026-0384","title":"Updated spice-vdagent packages fix security vulnerabilities","description":"Integer overflow in udscs_write() leading to heap buffer overflow.\n(CVE-2026-57965)\nPath traversal in file transfer via unsanitized filename.\n(CVE-2026-57966)\n","status":"published","published":"2026-09-09T04:15:20Z","modified":"2026-09-09T04:30:04.983912668Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11379-1","title":"spice-vdagent-0.23.0-4.1 on GA media","description":"These are all security issues fixed in the spice-vdagent-0.23.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-26T00:00:00Z","modified":"2026-07-27T09:00:10.051574989Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21506-1","title":"Security update for spice-vdagent","description":"This update for spice-vdagent fixes the following issues:\n\n- CVE-2026-57965: integer overflow in `udscs_write()` allows a compromised SPICE host to crash the `spice-vdagent`\n  daemon via a specially crafted message that triggers a heap buffer overflow (bsc#1269553).\n- CVE-2026-57966: improper sanitization allows a compromised SPICE host to write arbitrary files to any location on the\n  guest operating system (bsc#1269554).\n","status":"published","published":"2026-07-31T12:42:56Z","modified":"2026-08-02T18:24:04.040619809Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23109-1","title":"Security update for spice-vdagent","description":"This update for spice-vdagent fixes the following issues:\n\n- CVE-2026-57965: integer overflow in `udscs_write()` allows a compromised SPICE host to crash the `spice-vdagent`\n  daemon via a specially crafted message that triggers a heap buffer overflow (bsc#1269553).\n- CVE-2026-57966: improper sanitization allows a compromised SPICE host to write arbitrary files to any location on the\n  guest operating system (bsc#1269554).\n","status":"published","published":"2026-07-31T12:43:27Z","modified":"2026-08-14T18:23:39.564701707Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3470-1","title":"Security update for spice-vdagent","description":"This update for spice-vdagent fixes the following issues:\n\n- CVE-2026-57965: integer overflow in `udscs_write()` can lead to heap buffer overflow (bsc#1269553).\n- CVE-2026-57966: improper sanitization allows a compromised SPICE host to write arbitrary files to any location on the\n  guest operating system (bsc#1269554).\n","status":"published","published":"2026-08-03T16:42:19Z","modified":"2026-08-04T11:45:09.084996705Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3485-1","title":"Security update for spice-vdagent","description":"This update for spice-vdagent fixes the following issues:\n\n- CVE-2026-57965: integer overflow in `udscs_write()` can lead to heap buffer overflow (bsc#1269553).\n- CVE-2026-57966: improper sanitization allows a compromised SPICE host to write arbitrary files to any location on the\n  guest operating system (bsc#1269554).\n","status":"published","published":"2026-08-04T11:53:54Z","modified":"2026-08-04T18:30:05.191033269Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3585-1","title":"Security update for spice-vdagent","description":"This update for spice-vdagent fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2026-57965: integer overflow in `udscs_write()` can lead to heap buffer overflow (bsc#1269553).\n- CVE-2026-57966: improper sanitization allows a compromised SPICE host to write arbitrary files to any location on the\n  guest operating system (bsc#1269554).\n\nOther fixes:\n\n- Fix startup issues with spice-vdagent.service (bsc#1189821)\n","status":"published","published":"2026-08-11T14:46:46Z","modified":"2026-08-12T10:45:05.832697511Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8723-1","title":"spice-vdagent vulnerabilities","description":"It was discovered that SPICE vdagent had an integer overflow in the buffer\nsize calculation used when writing to the daemon socket. A malicious or\ncompromised SPICE host could possibly use this issue to cause SPICE vdagent\nto crash, resulting in a denial of service. (CVE-2026-57965)\n\nIt was discovered that SPICE vdagent did not properly sanitize filenames\nprovided by the SPICE host during file transfers. A malicious or\ncompromised SPICE host could possibly use this issue to write arbitrary\nfiles to any location on the guest operating system with the privileges of\nthe spice-vdagent process. (CVE-2026-57966)","status":"published","published":"2026-09-03T12:43:08Z","modified":"2026-09-03T22:56:55.471011368Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}