EUVD-2026-102856
GHSA-q367-g3jh-xmfv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as valid SPICE client
-
DeliveryAwait or trigger VM live migration
-
ExploitSend crafted SPICE_MSGC_MIGRATE_DATA with malicious offsets
-
ExecutionTrigger out-of-bounds read/write on message buffer
-
ImpactLeak heap memory or corrupt heap in spice-server
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated SPICE client session (PR:L) and a VM undergoing live migration - the flaw lives in the migration data handlers that parse client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages, so the attack is only viable during the migration window, which drives the high attack complexity (AC:H). Limiting factors: the attacker must already hold valid SPICE authentication, must time the malicious message to an in-progress migration, and must be able to reach the SPICE network endpoint; environments that restrict SPICE access to trusted operators or disable/segment the SPICE port substantially reduce real-world exposure. |
| Impact | This is a medium-to-high priority memory-corruption flaw rather than a mass-exploitation emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C:H/I:H/A:H) scores 7.5 and is internally consistent with the description: exploitation is network-reachable but gated by AC:H (the attacker must hit the narrow window of an active VM live migration and craft valid SPICE_MSGC_MIGRATE_DATA offsets) and PR:L (a valid, authenticated SPICE client session is required). The CWE-787 (out-of-bounds write) plus the described arbitrary heap read/write justify the full C:H/I:H/A:H impact on the spice-server (QEMU host) process. No EPSS score, KEV listing, or POC was supplied in the intelligence; absence of these signals - combined with the AC:H race-window requirement and authentication precondition - strongly suggests this is not a spray-and-pray target and is unlikely to see broad opportunistic exploitation. The main unknowns are the precise fixed/affected spice-server versions (only RHEL 6/7/8 CPEs are given, not package NVRs) and real-world exploitation likelihood; these should be confirmed against the Red Hat advisory. Treat as a patch-on-normal-cycle issue for virtualization hosts, escalating where untrusted parties can hold authenticated SPICE sessions. |
| Exploit ScenarioDerived | An attacker with a legitimate but malicious authenticated SPICE client session connects to a VM and waits for (or helps induce) a live migration. During the migration the client sends a crafted SPICE_MSGC_MIGRATE_DATA message carrying out-of-bounds offsets, causing spice-server to read adjacent heap memory (information disclosure) or write past the buffer (heap corruption, potentially leading to code execution in the host QEMU process). No public exploit was identified at time of analysis, and the high attack complexity (migration timing window) limits reliability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Out-of-bounds heap reads and writes in spice-server's SPICE_MSGC_MIGRATE_DATA handling let an authenticated SPICE client read arbitrary heap memory or corrupt the heap while a VM is undergoing live migration. Consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector, the attacker must already hold a valid SPICE session and must land the malicious message inside the migration window, so real-world exposure is concentrated in deployments where the SPICE endpoint is reachable by low-privilege or untrusted users. No public exploit code and no CISA KEV entry were identified at time of analysis.
RemediationAI
Apply the upstream spice-server fix referenced by the project merge request (https://gitlab.freedesktop.org/spice/spice/-/merge_requests/257) and follow Red Hat's advisory https://access.redhat.com/security/cve/CVE-2026-105958 for the exact errata versions per release; upstream fix available (PR/commit); released patched version not independently confirmed, so verify the fixed package revision in each RHEL 6, 7, or 8 channel before assuming coverage. Where patching cannot be scheduled immediately, remove the attack surface rather than relying on generic hardening: bind the SPICE endpoint to a dedicated management network or localhost and firewall it away from user-facing networks (side effect: remote console access must be brokered through a jump host or VPN), enforce TLS and strong SPICE authentication so PR:L attackers cannot get a session in the first place (side effect: client and configuration changes, and it does not help if legitimate low-privilege users already have SPICE credentials), and, because the vulnerable handlers are only reachable during migration, suspend or disable live migration on untrusted tenants' hosts until the patch lands (side effect: planned downtime for host maintenance or the loss of workload mobility). Segment migration traffic onto a separate VLAN as an additional limit, but treat it as defence in depth rather than a fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
spice-server is the server-side implementation of the SPICE remote-display protocol used by QEMU/KVM virtual machines, normally reachable on the SPICE network endpoint (commonly TCP 5900/5930, with or without TLS). During VM live migration the server processes SPICE_MSGC_MIGRATE_DATA messages whose payload contains client-supplied offsets into an internal message buffer; the affected migration data handlers dereference those offsets without checking them against the buffer's real length. That is a textbook CWE-787 out-of-bounds write, accompanied here by an out-of-bounds read that can disclose adjacent heap contents, and both arise from missing bounds validation of untrusted offset/length fields before the parse or copy step. Because these code paths are only exercised while a migration is actually in flight, the assessed vector carries AC:H alongside PR:L, reflecting the requirement for an authenticated session plus correct timing of the malicious message. The upstream fix is being discussed in the spice project's merge request 257, and Red Hat tracks the issue for the RHEL packages.
Know when Spice gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SPICE is network-reachable (AV:N) but needs an authenticated client (PR:L) and the narrow live-migration race window (AC:H); OOB read/write on the host spice-server process yields full C:H/I:H/A:H within an unchanged scope.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
Executive ViewAI
spice-server, the console-access component used by KVM/QEMU virtualization platforms, contains heap memory handling flaws that a user who already holds a valid SPICE session can trigger while a virtual machine is live-migrating, allowing arbitrary hypervisor heap memory to be read or the heap to be corrupted. Because the affected process serves multiple guests, a successful attack can expose secrets and data belonging to other tenants on the same host and can disrupt or crash virtual machines mid-migration. Leadership should care most in environments where SPICE endpoints are reachable by low-privilege, contractor, or untrusted users rather than being confined to a hardened management network, and there is currently no vendor-released patch.
No vendor-released patch identified at time of analysis. Interim mitigations: network-segment and firewall SPICE endpoints so they are reachable only from trusted management networks or a brokered jump host with MFA; enable and enforce SPICE TLS with strong per-session authentication and unique credentials per operator; disable SPICE console access for guests that do not require it; restrict the account population allowed to establish SPICE sessions; monitor hypervisor and SPICE logs for anomalous migrate-data traffic, migration failures, and host process crashes as an early indicator of attempted exploitation; and maintain a staged upgrade path ready to deploy the vendor patch as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Affected Products (CPE)CVE.org
The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or poss
Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers
A flaw was found in spice in versions before 0.14.92. Rated medium severity (CVSS 5.3), this vulnerability is remotely e
spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from
Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames.
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages l
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory
Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations
SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface p
Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display syste
Exploit-DB