CVE-2026-105958

Published: Oct 16, 2026Modified: Oct 16, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://access.redhat.com/security/cve/CVE-2026-105958

Source: secalert@redhat.com

https://gitlab.freedesktop.org/spice/spice/-/merge_requests/257

Source: secalert@redhat.com

Timeline

No history available yet.