spice-vdagent CVE-2026-57966

Exploitation requires that the SPICE host be either untrusted or explicitly compromised - the attacker must exercise control over the host side of the SPICE virtualization channel, representing a high-privilege prerequisite (PR:H). The specific trigger is a SPICE file transfer operation in which the host provides a filename containing path traversal sequences; the guest must be running spice-vdagent with the file transfer capability active (the default configuration when spice-vdagentd is running). Files are written with the privileges of the spice-vdagent process, typically those of the logged-in guest user rather than root, which constrains but does not eliminate the integrity impact. Exploitation is not possible from an unprivileged network attacker, an unauthenticated remote party, or an unprivileged guest user - it is strictly limited to scenarios where the SPICE host itself is adversarial.

The vendor-assigned CVSS 3.1 score of 4.4 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N accurately reflects the constrained threat model. The PR:H metric is the critical signal: an attacker must already control or have compromised the SPICE host - effectively requiring hypervisor-level or virtualization administrator access before any guest impact is possible. AV:L correctly captures that the attack traverses the SPICE protocol channel rather than an externally reachable network interface. No EPSS data was included in the intelligence, the vulnerability does not appear in the CISA KEV catalog, and no public POC has been identified - all signals consistent with a low exploitation urgency. The integrity impact is high (arbitrary file write to any guest path) but confidentiality and availability are not directly affected, and writes are scoped to the privileges of the logged-in guest user rather than root. In environments where the SPICE host and guest are managed by different trust domains - such as shared virtualization infrastructure or multi-tenant setups - this represents a genuine privilege-boundary concern. In typical enterprise deployments where the same team controls both host and guest, the practical risk is low.

An attacker who has gained control of the SPICE virtualization host - for example, through a compromised hypervisor management plane or a rogue cloud infrastructure operator - initiates a SPICE file transfer to a target guest VM, supplying a crafted filename such as '../../.bashrc' or '../../etc/cron.d/implant'. The spice-vdagent process on the guest, running with the logged-in user's privileges, writes the attacker-controlled file content to the traversed path, potentially overwriting shell initialization files or planting scheduled tasks. No public POC has been identified at time of analysis.