---
id: CVE-2026-105958
title: 'Spice-server: spice: heap oob read/write via unchecked migration data offsets'
summary: >-
  A flaw was found in spice-server. Multiple migration data handlers use
  client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds
  validation, allowing a malicious authenticated SPICE client during VM live
  migration to r…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: Red Hat
product: spice-server
affected:
  - spice-server (all versions)
  - spice (all versions)
  - spice (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T13:47:11.369874Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T13:47:54.538Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105958'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-105958'
  - url: 'https://gitlab.freedesktop.org/spice/spice/-/merge_requests/257'
tags:
  - cve.org
ingestedAt: '2026-10-16T13:06:42.679Z'
---

## Overview

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.

## Affected

- `spice-server (all versions)`
- `spice (all versions)`
- `spice (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

This vulnerability is only exploitable during VM live migration by an authenticated SPICE client. If live migration is not required, disabling it eliminates the attack surface. If live migration is needed, restrict SPICE client connections to trusted networks using firewall rules and enforce strong authentication (TLS with mutual certificate validation, or SASL with strong credentials) to limit who can connect as a SPICE client.