CVE-2026-57965: Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Other sources
An integer overflow vulnerability was found in spice-vdagent. In src/udscs.c, the udscswrite() function computes a buffer size as bufsize = sizeof(header) + size, where bufsize is a guint (unsigned 32-bit). When size is >= 0xFFFFFFF1 (since sizeof(header) is 16), this addition wraps to zero or a very small value. gmalloc(0) returns a valid tiny allocation (typically 1 byte), and the subsequent memcpy(buf + 16, data, size) writes approximately 4GB past the end of the buffer, causing a heap buffer overflow. This has been confirmed with AddressSanitizer (heap-buffer-overflow). On a normal (non-ASAN) build the daemon crashes with SIGBUS.
The trigger path is through VDAgentMessage.size in clipboard or file transfer messages from the SPICE host. The size validation at vdagentd.c:572 only checks >= minsize with no upper bound.
Note: exploitation requires a malicious or compromised SPICE host to send a crafted message with a large size field. In standard SPICE deployments, the host is trusted.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/spice-vdagentto a version that resolves this vulnerability.Fixed in 0.22.1-3+deb12u1Fixed in 0.23.0-3 - Configuration
Patch the size validation so it enforces an upper bound to prevent integer overflow in udscs_write(), where buf_size = sizeof(header) + size is stored in a guint (unsigned 32-bit). This must prevent the case where size >= 0xFFFFFFF1 (with sizeof(header)=16) causes the addition to wrap and result in a tiny g_malloc and out-of-bounds memcpy.
spice-vdagent (vdagentd.c:572 / udscs_write in src/udscs.c) VDAgentMessage.size validation = Add an upper bound (in addition to existing check of size >= min_size) - Compensating control
Ensure the SPICE host is trusted; do not allow an untrusted or compromised SPICE host, since exploitation requires a malicious/compromised SPICE host sending a crafted message with a large VDAgentMessage.size.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57965?
CVE-2026-57965 has a medium severity rating of 5.1.
What is the risk associated with CVE-2026-57965?
The risk level for CVE-2026-57965 is rated at 35.
How can CVE-2026-57965 affect my system?
CVE-2026-57965 can cause a Denial of Service (DoS) by triggering a heap buffer overflow, resulting in the spice-vdagent daemon crashing.
Who can exploit CVE-2026-57965?
A malicious or compromised SPICE host can exploit CVE-2026-57965 by sending specially crafted messages.
How do I mitigate the impact of CVE-2026-57965?
Mitigation for CVE-2026-57965 involves updating or patching the spice-vdagent software to a secure version.