CVE-2026-57965
published 2026-06-29CVE-2026-57965: A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This…
PriorityP423medium5.1CVSS 3.1
AVLACLPRHUINSUCNILAH
EPSS
0.11%
1.4th percentile
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| spice-space | spice-vdagent | — | — |
| ubuntu | spice-vdagent | — | — |
CVSS provenance
nvdv3.15.1MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
vendor_redhat5.1MEDIUM
vendor_ubuntu5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in spice-vdagent.
ghsa_unreviewed·2026-06-29
CVE-2026-57965 [MEDIUM] CWE-190 A flaw was found in spice-vdagent.
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Ubuntu
SPICE vdagent vulnerabilities
vendor_ubuntu·2026-09-03·CVSS 5.1
CVE-2026-57965 [MEDIUM] SPICE vdagent vulnerabilities
Title: SPICE vdagent vulnerabilities
Summary: Several security issues were fixed in SPICE vdagent.
It was discovered that SPICE vdagent had an integer overflow in the buffer
size calculation used when writing to the daemon socket. A malicious or
compromised SPICE host could possibly use this issue to cause SPICE vdagent
to crash, resulting in a denial of service. (CVE-2026-57965)
It was discovered that SPICE vdagent did not properly sanitize filenames
provided by the SPICE host during file transfers. A malicious or
compromised SPICE host could possibly use this issue to write arbitrary
files to any location on the guest operating system with the privileges of
the spice-vdagent process. (CVE-2026-57966)
Instructions: After a standard system update you need to restart spice-vdagent to ma
Red Hat
spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
vendor_redhat·2026-05-27·CVSS 5.1
CVE-2026-57965 [MEDIUM] CWE-190 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Package: spice-vdagent (Red Hat Enterprise Linux 10) - Fix deferred
Package: spice-vdagent (Red Hat Enterprise Linux 6) - Fix deferred
Package: spice-vdagent (Red Hat Enterprise Linux 7) - Fix deferred
Package: mingw-spice-vdagent (Red Hat Enterprise Linux 8) - Fix deferred
Package: spice-vdagent (Red Hat Enterprise L
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow [fedora-all]
bugzilla·2026-06-29·CVSS 5.1
CVE-2026-57965 [MEDIUM] CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow [fedora-all]
CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An integer overflow vulnerability was found in spice-vdagent. In src/udscs.c, the udscs_write() function computes a buffer size as buf_size = sizeof(header) + size, where buf_size is a guint (unsigned 32-bit). When size is >= 0xFFFFFFF1 (since sizeof(header) is 16), this addition wraps to zero or a very small value. g_malloc(0) returns a valid tiny allocation (typically 1 byte), and the subsequent memcpy(buf + 16, data, size) writes approximately 4GB past the e
Bugzilla
CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
bugzilla·2026-06-26·CVSS 5.1
CVE-2026-57965 [MEDIUM] CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
CVE-2026-57965 spice-vdagent: Integer overflow in udscs_write() leading to heap buffer overflow
An integer overflow vulnerability was found in spice-vdagent. In src/udscs.c, the udscs_write() function computes a buffer size as buf_size = sizeof(header) + size, where buf_size is a guint (unsigned 32-bit). When size is >= 0xFFFFFFF1 (since sizeof(header) is 16), this addition wraps to zero or a very small value. g_malloc(0) returns a valid tiny allocation (typically 1 byte), and the subsequent memcpy(buf + 16, data, size) writes approximately 4GB past the end of the buffer, causing a heap buffer overflow. This has been confirmed with AddressSanitizer (heap-buffer-overflow). On a normal (non-ASAN) build the daemon crashes with SIGBUS.
The trigger path is through VDAgentMessage.size in clipb
2026-06-29
Published