CVE-2026-105959: Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders value in migration data.
Other sources
The GLZ encoder dictionary restore path in the SPICE server truncates a sizet allocation size to int when calling the GlzEncoderUsrContext::malloc callback. The client-controlled maxencoders value from migration data controls the allocation size via sizeof(uint32t) maxencoders.
On 64-bit systems, with a crafted maxencoders value (e.g., 0xC0000001), the product sizeof(uint32t) 0xC0000001 = 0x300000004 (sizet) is truncated to int value 4, causing gmalloc to allocate only 4 bytes. The subsequent reset loop (glz-encoder-dict.c lines 104-107) then writes 4 bytes per iteration for 0xC0000001 iterations into the 4-byte buffer, resulting in a massive heap buffer overflow (~12.88 GB write past the allocation).
Exploitation requires SPICE client authentication (ticket or SASL) and an active live migration window. The attacker sends a crafted SPICEMSGCMIGRATEDATA on the display channel with a malicious maxencoders value in GlzEncDictRestoreData.
Upstream fix: https://gitlab.freedesktop.org/spice/spice/-/mergerequests/253 (merged 2026-10-09)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
spice-serverto a version that resolves this vulnerability.Patch https://gitlab.freedesktop.org/spice/spice/-/merge_requests/253
Event History
Frequently Asked Questions
Who is realistically exposed to this flaw?
SPICE servers running on 64-bit systems are exposed when they accept authenticated SPICE clients and perform live VM migration. Exploitation requires an active live migration window.
What does an attacker need to exploit it?
The attacker needs valid SPICE client authentication using a ticket or SASL, plus the ability to send crafted migration data during live migration. The crafted max_encoders value controls the undersized allocation and subsequent overflow.
Is an unauthenticated network attacker affected by this issue?
No. The provided information states that SPICE client authentication is required, so an attacker must authenticate before attempting exploitation.