CVE-2026-105958High· 7.5▾ TwilightA flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to r…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
spice-server (all versions)spice (all versions)spice (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
This vulnerability is only exploitable during VM live migration by an authenticated SPICE client. If live migration is not required, disabling it eliminates the attack surface. If live migration is needed, restrict SPICE client connections to trusted networks using firewall rules and enforce strong authentication (TLS with mutual certificate validation, or SASL with strong credentials) to limit who can connect as a SPICE client.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105959High· 7.5Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
CVE-2026-111379High· 7.3freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file (CVE-2026-111379)
CVE-2026-111382High· 8.8freerdp: freerdp: Arbitrary code execution via crafted display frames (CVE-2026-111382)
CVE-2026-86856Medium· 6.5A flaw was found in the DPDK nfp vDPA driver
CVE-2026-86849Medium· 6.5A flaw was found in DPDK lib/vhost vhost-crypto
CVE-2026-86846Medium· 6.5A flaw was found in DPDK lib/vhost vhost-crypto