REDHAT-BUG-2554008: Buffer Overflow
The GLZ encoder dictionary restore path in the SPICE server truncates a sizet allocation size to int when calling the GlzEncoderUsrContext::malloc callback. The client-controlled maxencoders value from migration data controls the allocation size via sizeof(uint32t) maxencoders.
On 64-bit systems, with a crafted maxencoders value (e.g., 0xC0000001), the product sizeof(uint32t) 0xC0000001 = 0x300000004 (sizet) is truncated to int value 4, causing gmalloc to allocate only 4 bytes. The subsequent reset loop (glz-encoder-dict.c lines 104-107) then writes 4 bytes per iteration for 0xC0000001 iterations into the 4-byte buffer, resulting in a massive heap buffer overflow (~12.88 GB write past the allocation).
Exploitation requires SPICE client authentication (ticket or SASL) and an active live migration window. The attacker sends a crafted SPICEMSGCMIGRATEDATA on the display channel with a malicious maxencoders value in GlzEncDictRestoreData.
Upstream fix: https://gitlab.freedesktop.org/spice/spice/-/mergerequests/253 (merged 2026-10-09)
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker must be able to authenticate as a SPICE client using ticket or SASL authentication. Exploitation also requires an active live migration window.
What attacker-controlled input triggers the overflow?
The attacker sends a crafted SPICE_MSGC_MIGRATE_DATA message on the display channel. Its GlzEncDictRestoreData max_encoders value controls the allocation calculation and can cause the size to be truncated before allocation.
Are systems affected during ordinary SPICE use?
The described exploit path requires live migration, so the vulnerable dictionary restore path is reached during an active migration window rather than ordinary non-migration operation.
What can be done before the upstream fix is available?
Limit SPICE client access to trusted authenticated users and avoid or restrict live migrations where practical. The reported attack requires both valid SPICE authentication and a live migration window.
How can defenders identify a potential exploitation attempt?
Review SPICE display-channel traffic during live migration for SPICE_MSGC_MIGRATE_DATA messages containing anomalous GlzEncDictRestoreData max_encoders values. The example malicious value is 0xC0000001.