The GLZ encoder dictionary restore path in the SPICE server truncates a sizet allocation size to int when calling the GlzEncoderUsrContext::malloc callback. The client-controlled maxencoders value from migration data controls the allocation size via sizeof(uint32t) maxencoders.

On 64-bit systems, with a crafted maxencoders value (e.g., 0xC0000001), the product sizeof(uint32t) 0xC0000001 = 0x300000004 (sizet) is truncated to int value 4, causing gmalloc to allocate only 4 bytes. The subsequent reset loop (glz-encoder-dict.c lines 104-107) then writes 4 bytes per iteration for 0xC0000001 iterations into the 4-byte buffer, resulting in a massive heap buffer overflow (~12.88 GB write past the allocation).

Exploitation requires SPICE client authentication (ticket or SASL) and an active live migration window. The attacker sends a crafted SPICEMSGCMIGRATEDATA on the display channel with a malicious maxencoders value in GlzEncDictRestoreData.

Upstream fix: https://gitlab.freedesktop.org/spice/spice/-/mergerequests/253 (merged 2026-10-09)