CVE catalog

CVE-2026-105958

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.25% · Oct 25, 2026

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspicesid0.16.0-3vulnerable
Debianspiceforky0.16.0-3vulnerable
Debianspicetrixie0.15.2-1vulnerable
Debianspicebookworm0.15.1-1vulnerable
Ubuntuspicepro0.12.4-0nocelt1vulnerable
Ubuntuspicepro0.12.4-0nocelt1.1vulnerable
Ubuntuspicepro0.12.4-0nocelt1.1ubuntu1vulnerable
Ubuntuspicepro0.12.4-0nocelt2vulnerable
Ubuntuspicepro0.12.4-0nocelt2ubuntu1vulnerable
Ubuntuspicepro0.12.4-0nocelt2ubuntu1.1vulnerable
Ubuntuspicepro0.12.4-0nocelt2ubuntu1.2vulnerable
Ubuntuspicepro0.12.4-0nocelt2ubuntu1.3vulnerable
Ubuntuspicepro0.12.4-0nocelt2ubuntu1.4vulnerable
Ubuntuspicepro0.12.4-0nocelt2ubuntu1.5vulnerable
Ubuntuspicepro0.12.4-0nocelt2ubuntu1.6vulnerable
Ubuntuspicepro0.12.4-0nocelt2ubuntu1.7vulnerable
Ubuntuspicepro0.12.4-0nocelt2ubuntu1.8vulnerable
Ubuntuspicepro0.12.4-0nocelt2ubuntu1.8+esm1vulnerable
Ubuntuspice16.040.12.5-1.1ubuntu2vulnerable
Ubuntuspice16.040.12.6-4vulnerable
Ubuntuspice16.040.12.6-4ubuntu0.1vulnerable
Ubuntuspice16.040.12.6-4ubuntu0.2vulnerable
Ubuntuspice16.040.12.6-4ubuntu0.3vulnerable
Ubuntuspice16.040.12.6-4ubuntu0.4vulnerable
Ubuntuspice16.040.12.6-4ubuntu0.5vulnerable
Ubuntuspice-protocol16.040.12.7-1vulnerable
Ubuntuspice-protocol16.040.12.10-1vulnerable
Ubuntuspice-protocol16.040.12.10-1ubuntu0.1vulnerable
Ubuntuspice-protocol16.040.12.10-1ubuntu0.2vulnerable
Ubuntuspice-gtk16.040.28-1ubuntu1vulnerable
Ubuntuspice-gtk16.040.29-1vulnerable
Ubuntuspice-gtk16.040.30-1vulnerable
Ubuntuspice18.040.12.8-2.2vulnerable
Ubuntuspice18.040.14.0-1vulnerable
Ubuntuspice18.040.14.0-1ubuntu1vulnerable
Ubuntuspice18.040.14.0-1ubuntu2vulnerable
Ubuntuspice18.040.14.0-1ubuntu2.1vulnerable
Ubuntuspice18.040.14.0-1ubuntu2.2vulnerable
Ubuntuspice18.040.14.0-1ubuntu2.4vulnerable
Ubuntuspice18.040.14.0-1ubuntu2.5vulnerable
Ubuntuspice-protocol18.040.12.13-2vulnerable
Ubuntuspice-gtk18.040.33-3.3vulnerable
Ubuntuspice-gtk18.040.34-1.1vulnerable
Ubuntuspice-gtk18.040.34-1.1build1vulnerable
Ubuntuspice20.040.14.2-0ubuntu2vulnerable
Ubuntuspice20.040.14.2-4ubuntu1vulnerable
Ubuntuspice20.040.14.2-4ubuntu2vulnerable
Ubuntuspice20.040.14.2-4ubuntu3vulnerable
Ubuntuspice20.040.14.2-4ubuntu3.1vulnerable
Ubuntuspice-protocol20.040.14.0-0ubuntu1vulnerable
Ubuntuspice-gtk20.040.37-0ubuntu1vulnerable
Ubuntuspice-gtk20.040.37-0ubuntu2vulnerable
Ubuntuspice-gtk20.040.37-2fakesync1vulnerable
Ubuntuspice22.040.14.3-2.1ubuntu1vulnerable
Ubuntuspice22.040.15.0-2ubuntu1vulnerable
Ubuntuspice22.040.15.0-2ubuntu2vulnerable
Ubuntuspice22.040.15.0-2ubuntu3vulnerable
Ubuntuspice22.040.15.0-2ubuntu4vulnerable
Ubuntuspice-gtk22.040.39-1vulnerable
Ubuntuspice-gtk22.040.39-3vulnerable
Ubuntuspice-gtk22.040.39-3ubuntu1vulnerable
Ubuntuspice-protocol22.040.14.3-1vulnerable
Ubuntuspice24.040.15.1-1vulnerable
Ubuntuspice24.040.15.1-1build1vulnerable
Ubuntuspice24.040.15.1-1build2vulnerable
Ubuntuspice-gtk24.040.42-2vulnerable
Ubuntuspice-gtk24.040.42-2ubuntu1vulnerable
Ubuntuspice-gtk24.040.42-2ubuntu2vulnerable
Ubuntuspice-protocol24.040.14.3-1vulnerable
Ubuntuspice26.100.16.0-1vulnerable
Ubuntuspice26.100.16.0-2vulnerable
Ubuntuspice26.100.16.0-3vulnerable
Ubuntuspice-gtk26.100.42-4build1vulnerable
Ubuntuspice-gtk26.100.42-4build2vulnerable
Ubuntuspice-protocol26.100.14.5-1build1vulnerable
Ubuntuspice26.040.15.2-1vulnerable
Ubuntuspice26.040.16.0-1vulnerable
Ubuntuspice-gtk26.040.42-4vulnerable
Ubuntuspice-gtk26.040.42-4build1vulnerable
Ubuntuspice-protocol26.040.14.3-1vulnerable
Ubuntuspice-protocol26.040.14.5-1vulnerable
Ubuntuspice-protocol26.040.14.5-1build1vulnerable
Opensusespicetumbleweed0.16.0-3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspicesourcesid(unfixed)not yet assignedNot reported[1151201]
Debianspicesourceforky(unfixed)not yet assignedNot reported[1151201]
Debianspicesourcetrixie(unfixed)not yet assignedNot reported[1151201]
Debianspicesourcebookworm(unfixed)not yet assignedNot reported[1151201]
Opensusespicerpmtumbleweed0.16.0-3.1Not reportedOPENSUSE-SU-2026:12222-1Not reported

[Debian bug #1151201]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libspice-server1]Affected

    Source package: [spice]

    Details (2)

    • 0.15.1-1 · amd64 · bookworm

      Affected

      nvd · spice · debian · bookworm

    • 0.15.1-1 · arm64 · bookworm

      Affected

      nvd · spice · debian · bookworm

  • [libspice-server-dev]Affected

    Source package: [spice]

    Details (2)

    • 0.15.1-1 · amd64 · bookworm

      Affected

      nvd · spice · debian · bookworm

    • 0.15.1-1 · arm64 · bookworm

      Affected

      nvd · spice · debian · bookworm

[openSUSE Tumbleweed]

  • [libspice-server1]Unknown

    Source package: [spice]

    Details (1)

    • 0.16.0-1.5 · x86_64 · tumbleweed

      Unknown · Fixed: 0.16.0-3.1

      Version impact unknown

      nvd · spice · opensuse · tumbleweed

  • [libspice-server-devel]Unknown

    Source package: [spice]

    Details (1)

    • 0.16.0-1.5 · x86_64 · tumbleweed

      Unknown · Fixed: 0.16.0-3.1

      Version impact unknown

      nvd · spice · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]