CVE-2026-57965 — Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow

Affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9

A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.

USN-8723-1 — spice-vdagent vulnerabilities

Affected: Ubuntu:22.04:LTS: spice-vdagent, Ubuntu:24.04:LTS: spice-vdagent, Ubuntu:26.04:LTS: spice-vdagent

It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, resulting in a denial of service. (CVE-2026-57965)

It was discovered that SPICE vdagent did not properly sanitize filenames provided by the SPICE host during file transfers. A malicious or compromised SPICE host could possibly use this issue to write arbitrary files to any location on the guest operating system with the privileges of the spice-vdagent process. (CVE-2026-57966)

Most recent entries from all

CVE-2026-57965 — Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow

USN-8723-1 — spice-vdagent vulnerabilities