CVE-2026-57965: Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Other sources
An integer overflow vulnerability was found in spice-vdagent. In src/udscs.c, the udscswrite() function computes a buffer size as bufsize = sizeof(header) + size, where bufsize is a guint (unsigned 32-bit). When size is >= 0xFFFFFFF1 (since sizeof(header) is 16), this addition wraps to zero or a very small value. gmalloc(0) returns a valid tiny allocation (typically 1 byte), and the subsequent memcpy(buf + 16, data, size) writes approximately 4GB past the end of the buffer, causing a heap buffer overflow. This has been confirmed with AddressSanitizer (heap-buffer-overflow). On a normal (non-ASAN) build the daemon crashes with SIGBUS.
The trigger path is through VDAgentMessage.size in clipboard or file transfer messages from the SPICE host. The size validation at vdagentd.c:572 only checks >= minsize with no upper bound.
Note: exploitation requires a malicious or compromised SPICE host to send a crafted message with a large size field. In standard SPICE deployments, the host is trusted.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57965?
CVE-2026-57965 has a medium severity rating of 5.1.
What is the risk associated with CVE-2026-57965?
The risk level for CVE-2026-57965 is rated at 35.
How can CVE-2026-57965 affect my system?
CVE-2026-57965 can cause a Denial of Service (DoS) by triggering a heap buffer overflow, resulting in the spice-vdagent daemon crashing.
Who can exploit CVE-2026-57965?
A malicious or compromised SPICE host can exploit CVE-2026-57965 by sending specially crafted messages.
How do I mitigate the impact of CVE-2026-57965?
Mitigation for CVE-2026-57965 involves updating or patching the spice-vdagent software to a secure version.