{"id":"CVE-2026-105958","title":"Spice-server: spice: heap oob read/write via unchecked migration data offsets","summary":"A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to r…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Red Hat","product":"spice-server","affected":["spice-server (all versions)","spice (all versions)","spice (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T13:47:11.369874Z"},"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T13:47:54.538Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105958","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-105958"},{"url":"https://gitlab.freedesktop.org/spice/spice/-/merge_requests/257"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T13:06:42.679Z","slug":"CVE-2026-105958","body":"## Overview\n\nA flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.\n\n## Affected\n\n- `spice-server (all versions)`\n- `spice (all versions)`\n- `spice (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nThis vulnerability is only exploitable during VM live migration by an authenticated SPICE client. If live migration is not required, disabling it eliminates the attack surface. If live migration is needed, restrict SPICE client connections to trusted networks using firewall rules and enforce strong authentication (TLS with mutual certificate validation, or SASL with strong credentials) to limit who can connect as a SPICE client.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}