CVE-2026-105958: Spice-server: spice: heap oob read/write via unchecked migration data offsets
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running spice-server are exposed when they perform VM live migration and accept migration data from an authenticated SPICE client. The issue is not described as exploitable by an unauthenticated client.
What does an attacker need to exploit it?
An attacker needs valid SPICE client authentication and must be able to send crafted SPICE_MSGC_MIGRATE_DATA messages during VM live migration. Exploitation relies on supplying offsets that are not validated against the migration message buffer bounds.
What could successful exploitation allow?
A malicious client may read arbitrary heap memory or cause heap corruption through out-of-bounds reads and writes on the message buffer. The reported impact includes confidentiality, integrity, and availability consequences.