Skip to main content

spice-vdagent CVE-2026-57966

| EUVDEUVD-2026-40050 MEDIUM
Path Traversal (CWE-22)
2026-06-29 redhat GHSA-gg66-359m-pmcc
Path Traversal Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Suse Red Hat
4.4
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
vuln.today AI
4.4 MEDIUM

AV:L reflects SPICE protocol channel access; PR:H captures mandatory SPICE host control; I:H for arbitrary guest file write; no confidentiality or availability impact applies.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat
4.4 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jun 29, 2026 - 09:18 vuln.today
CVE Published
Jun 29, 2026 - 07:53 cve.org
MEDIUM 4.4

DescriptionCVE.org

A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be untrusted or compromised for exploitation.

AnalysisAI

Path traversal in spice-vdagent enables a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system during file transfer operations. Affecting Red Hat Enterprise Linux versions 6 through 10, the flaw stems from unsanitized filenames supplied by the SPICE host before use by the vdagent process, allowing writes at the privilege level of the logged-in guest user. No public exploit is identified at time of analysis, and exploitation requires prior control of the SPICE host - a high-privilege precondition that substantially constrains realistic risk despite the high integrity impact.

Technical ContextAI

spice-vdagent is a daemon running inside guest virtual machines to support SPICE protocol features including clipboard sharing, display resolution adjustment, and file transfers between host and guest. The vulnerability is classified as CWE-22 (Path Traversal): during a SPICE file transfer, the host supplies the destination filename, which spice-vdagent uses without sanitizing directory traversal sequences such as '../' or absolute path components. This allows the host to dictate where on the guest filesystem the transferred file lands. The SPICE protocol is developed by Red Hat and is the primary display and I/O protocol for KVM/QEMU virtualization and Red Hat Virtualization (RHV/oVirt) environments. CPE data confirms the affected package spans the spice-vdagent component as shipped in RHEL 6 through RHEL 10.

RemediationAI

No explicit patched package version is confirmed in the available intelligence; consult the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-57966 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2493582 for the latest errata package. Until a patched spice-vdagent RPM is applied via 'yum update spice-vdagent' or 'dnf update spice-vdagent', consider disabling the SPICE file transfer feature entirely if it is not required - this can be achieved by stopping and masking the vdagent service ('systemctl stop spice-vdagentd && systemctl mask spice-vdagentd') on guests where file sharing is unnecessary; note this also disables clipboard sharing and dynamic display resolution. Restricting SPICE host access strictly to trusted administrators reduces the attack surface, since exploitation requires a compromised or adversarial host. In multi-tenant or cloud environments where the SPICE host is not under the guest owner's control, disabling vdagent file transfer capability is the most effective compensating control until a patch is applied.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-57966 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy