CVE-2026-57965
published 2026-06-29CVE-2026-57965: A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This…
PriorityP423medium5.1CVSS 3.1
AVLACLPRHUINSUCNILAH
EPSS
0.12%
2.0th percentile
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| spice-space | spice-vdagent | — | — |
CVSS provenance
nvdv3.15.1MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
vendor_redhat5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in spice-vdagent.
ghsa_unreviewed·2026-06-29
CVE-2026-57965 [MEDIUM] CWE-190 A flaw was found in spice-vdagent.
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Red Hat
spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
vendor_redhat·2026-05-27·CVSS 5.1
CVE-2026-57965 [MEDIUM] CWE-190 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Package: spice-vdagent (Red Hat Enterprise Linux 10) - Fix deferred
Package: spice-vdagent (Red Hat Enterprise Linux 6) - Fix deferred
Package: spice-vdagent (Red Hat Enterprise Linux 7) - Fix deferred
Package: mingw-spice-vdagent (Red Hat Enterprise Linux 8) - Fix deferred
Package: spice-vdagent (Red Hat Enterprise L
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow [fedora-all]
bugzilla·2026-06-29·CVSS 5.1
CVE-2026-57965 [MEDIUM] CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow [fedora-all]
CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An integer overflow vulnerability was found in spice-vdagent. In src/udscs.c, the udscs_write() function computes a buffer size as buf_size = sizeof(header) + size, where buf_size is a guint (unsigned 32-bit). When size is >= 0xFFFFFFF1 (since sizeof(header) is 16), this addition wraps to zero or a very small value. g_malloc(0) returns a valid tiny allocation (typically 1 byte), and the subsequent memcpy(buf + 16, data, size) writes approximately 4GB past the e
Bugzilla
CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
bugzilla·2026-06-26·CVSS 5.1
CVE-2026-57965 [MEDIUM] CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
An integer overflow vulnerability was found in spice-vdagent. In src/udscs.c, the udscs_write() function computes a buffer size as buf_size = sizeof(header) + size, where buf_size is a guint (unsigned 32-bit). When size is >= 0xFFFFFFF1 (since sizeof(header) is 16), this addition wraps to zero or a very small value. g_malloc(0) returns a valid tiny allocation (typically 1 byte), and the subsequent memcpy(buf + 16, data, size) writes approximately 4GB past the end of the buffer, causing a heap buffer overflow. This has been confirmed with AddressSanitizer (heap-buffer-overflow). On a normal (non-ASAN) build the daemon crashes with SIGBUS.
The trigger path is through VDAgentMessage.size in clipb
2026-06-29
Published