Heap Memory Exposure in Spice-Server by Red Hat
CVE-2026-105958

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
16 October 2026

What is CVE-2026-105958?

A vulnerability exists in Spice-Server that permits an authenticated SPICE client to manipulate migration data without proper bounds validation. During virtual machine live migration, this flaw can enable the client to access arbitrary heap memory, leading to potential heap corruption through out-of-bounds read and write operations on the message buffer.

References

https://access.redhat.com/security/cve/CVE-2026-105958
vdb-entryx_refsource_REDHAT
https://gitlab.freedesktop.org/spice/spice/-/merge_reques...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Upstream acknowledges Tristan Madani (Talence Security) as the original reporter.
.