spice-vdagent CVE-2026-57965

Exploitation requires that the SPICE host communicating with the target guest VM be either malicious by design or already compromised - this prerequisite is explicitly stated in the CVE description ('requires the SPICE host to be untrusted or compromised for exploitation'). The CVSS PR:H metric reflects this: the attacker must hold a privilege level equivalent to controlling the SPICE server or hypervisor layer before the attack path is available. The guest VM must be running the spice-vdagent daemon and actively connected to the attacker-controlled SPICE host via the SPICE virtual channel. Exploitation is not possible from a guest-only attacker position, from an external network without prior host compromise, or without the spice-vdagent daemon running. Limiting factors: attacker must control hypervisor or SPICE server infrastructure (PR:H); no network-reachable attack path exists from outside the virtualization layer; impact is limited to crashing the vdagent daemon (DoS) with no confirmed remote code execution or confidentiality breach; and no special guest-side configuration is required beyond spice-vdagent being installed and running.

The CVSS 3.1 base score of 5.1 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H accurately reflects constrained real-world risk. The local attack vector (AV:L) confirms that exploitation does not traverse a conventional network path - the SPICE virtual channel is an in-hypervisor communication mechanism invisible to the guest's network stack. The high privilege requirement (PR:H) is the dominant limiting factor: the attacker must already control or have compromised the SPICE host or hypervisor before any exploitation is possible, a substantial prerequisite that sharply reduces the exposed population. Impact is primarily availability (A:H - daemon crash, DoS within the guest VM) with minor integrity impact (I:L, likely from heap corruption) and zero confidentiality impact (C:N). No EPSS score is present in available intelligence data and no KEV listing exists, and no public proof-of-concept has been identified - suggesting no active widespread exploitation at time of analysis. The practical threat model is most relevant in shared or multitenant virtualization environments (cloud IaaS, VDI platforms) where the guest operator does not fully control or trust the underlying SPICE host infrastructure. In typical enterprise deployments where the same team controls both guest and host, real-world exploitability is very low.

An attacker who has compromised or otherwise controls a SPICE host crafts a malformed SPICE protocol message embedding a length or count value engineered to overflow during integer arithmetic in spice-vdagent's message parser. The overflow causes allocation of an undersized heap buffer, and the subsequent write of the full payload triggers a heap buffer overflow, crashing the spice-vdagent daemon and causing a Denial of Service for the affected guest VM. No public proof-of-concept has been identified at time of analysis.