A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders value in migration data.

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.

The GLZ encoder dictionary restore path in the SPICE server truncates a sizet allocation size to int when calling the GlzEncoderUsrContext::malloc callback. The client-controlled maxencoders value from migration data controls the allocation size via sizeof(uint32t) maxencoders.

On 64-bit systems, with a crafted maxencoders value (e.g., 0xC0000001), the product sizeof(uint32t) 0xC0000001 = 0x300000004 (sizet) is truncated to int value 4, causing gmalloc to allocate only 4 bytes. The subsequent reset loop (glz-encoder-dict.c lines 104-107) then writes 4 bytes per iteration for 0xC0000001 iterations into the 4-byte buffer, resulting in a massive heap buffer overflow (~12.88 GB write past the allocation).

Exploitation requires SPICE client authentication (ticket or SASL) and an active live migration window. The attacker sends a crafted SPICEMSGCMIGRATEDATA on the display channel with a malicious maxencoders value in GlzEncDictRestoreData.

Upstream fix: https://gitlab.freedesktop.org/spice/spice/-/mergerequests/253 (merged 2026-10-09)

An unquoted search path flaw was found in the way Spice service for Windows was installed into the system.

A local unprivileged user could use this flaw to increase their privileges.

References:

http://cwe.mitre.org/data/definitions/428.html

The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spicestartersitesimportercreater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo content.

It was discovered that the spice-gtk setuid helper application, spice-client-glib-usb-acl-helper, did not clear the environment variables read by the libraries it uses. A local attacker could possibly use this flaw to escalate their privileges by setting specific environment variables before running the helper application.

This flaw is similar to CVE-2012-3524

An uninitialized pointer use flaw was found in the SPICE Firefox plug-in. If a user were tricked into visiting a malicious web page with Firefox while the SPICE plug-in is enabled, it could cause Firefox to crash or, possibly, execute arbitrary code with the privileges of the user running Firefox.

The CAC(Common Access Card) library, used by Quick Emulator(Qemu) to implement smartcard support, is vulnerable to a host memory leakage issue. It could occur while allocating a new APDU object using guest supplied raw byte stream in 'vcardapdunew'.

A guest user/process could use this flaw to leak host memory resulting in DoS.

Upstream patch: --------------- -> https://cgit.freedesktop.org/spice/libcacard/commit/?id=9113dc6a303604a2d9812ac70c17d076ef11886c

Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/03/01/11