CVE-2026-105959— Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 6
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 spice-server 中发现一个安全漏洞。GLZ 编码器的字典恢复路径在调用 malloc 回调时，将 size_t 类型的分配大小截断为 int 类型，导致在虚拟机实时迁移过程中，恶意的已认证 SPICE 客户端可通过在迁移数据中发送精心构造的 max_encoders 值，触发严重的堆缓冲区溢出。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 6 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105959
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
II. Public POCs for CVE-2026-105959
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105959
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-105959 (1)
Vendor Advisories for CVE-2026-105959 (2)
Same Patch Batch · Red Hat · 2026-10-16 · 15 CVEs total
| CVE-2026-104715 | 7.8 HIGH | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary by |
| CVE-2026-105958 | 7.5 HIGH | Spice-server: spice: heap oob read/write via unchecked migration data offsets |
| CVE-2026-62439 | 7.0 HIGH | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow |
| CVE-2026-89085 | 6.6 MEDIUM | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image |
| CVE-2026-111802 | 6.6 MEDIUM | Nautilus: nautilus: arbitrary file deletion via trash symlink |
| CVE-2026-85231 | 6.5 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss de |
| CVE-2026-62438 | 6.1 MEDIUM | Gimp: gimp: paa integer overflow out-of-bounds read |
| CVE-2026-111555 | 6.0 MEDIUM | Luksmeta: missing slot-range validation permits out-of-gap device i/o |
| CVE-2026-89096 | 5.9 MEDIUM | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd |
| CVE-2026-89088 | 5.5 MEDIUM | Parted: parted: denial of service via heap buffer overflow during fat16 resize |
| CVE-2026-89098 | 5.5 MEDIUM | Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd |
| CVE-2026-85977 | 5.3 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper re |
| CVE-2026-17591 | 3.6 LOW | Libarchive: libarchive: use-after-free via aliased mac metadata copy |
| CVE-2026-111581 | 3.3 LOW | Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 6
-
CVE-2026-105958
Spice-server: spice: heap oob read/write via unchecked migra -
CVE-2026-107651
Eog: eog: arbitrary code execution via heap buffer overflow -
CVE-2026-102474
Dash: dash: heap out-of-bounds write in conv_escape via unde -
CVE-2026-102473
Dash: dash: super-polynomial backtracking in pmatch when lib -
CVE-2026-90949
Gimp: gimp: heap-based buffer overflow in psp loader due to
Same vendor: Red Hat
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-17591
Libarchive: libarchive: use-after-free via aliased mac metad
Same weakness: CWE-190
-
CVE-2026-62438
Gimp: gimp: paa integer overflow out-of-bounds read -
CVE-2026-62439
Gimp: gimp: file-pvr plug-in pvr file parsing integer overfl -
CVE-2026-102834
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infi -
CVE-2026-102692
RIOT: Potential integer overflow in nanocoap Block2 handling -
CVE-2026-57488
pupnp: Integer truncation in HTTP Content-Length parsing ena
V. Comments for CVE-2026-105959
No comments yet