CVE-2026-105959

Name of the Vulnerable Software and Affected Versions spice-server (affected versions not specified)

Description A flaw exists in the GLZ encoder dictionary restore path where a size t allocation size is truncated to an int during a malloc callback. An authenticated SPICE client can exploit this during VM live migration by sending a crafted max encoders value in the migration data, leading to a massive heap buffer overflow. A heap buffer overflow occurs when a program writes more data to a heap-allocated memory block than it can hold, potentially corrupting memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.