CVE catalog

CVE-2026-57965

A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow,

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.11% · Oct 25, 2026

A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspice-vdagentsid0.23.0-4fixed
Debianspice-vdagentforky0.23.0-4fixed
Debianspice-vdagenttrixie0.22.1-4.1vulnerable
Debianspice-vdagentbookworm0.22.1-3vulnerable
Debianspice-vdagentbookworm-security0.22.1-3+deb12u1fixed
Cpeenterprise_linuxNot reportedNot reportedunknown
Cpespice-vdagentNot reportedNot reportedunknown
Ubuntuspice-vdagentnoble0.22.1-4ubuntu0.1fixed
Ubuntuspice-vdagent22.040.20.0-2build1vulnerable
Ubuntuspice-vdagent22.040.20.0-3vulnerable
Ubuntuspice-vdagent22.040.22.1-1vulnerable
Ubuntuspice-vdagent22.040.22.1-1ubuntu0.1fixed
Ubuntuspice-vdagent24.040.22.1-3vulnerable
Ubuntuspice-vdagent24.040.22.1-4vulnerable
Ubuntuspice-vdagent24.040.22.1-4build1vulnerable
Ubuntuspice-vdagent24.040.22.1-4build2vulnerable
Ubuntuspice-vdagent24.040.22.1-4build3vulnerable
Ubuntuspice-vdagent24.040.22.1-4ubuntu0.1fixed
Ubuntuspice-vdagent26.040.22.1-5vulnerable
Ubuntuspice-vdagent26.040.23.0-1vulnerable
Ubuntuspice-vdagent26.040.23.0-1ubuntu0.1fixed
Ubuntuspice-vdagent16.040.15.0-1.3vulnerable
Ubuntuspice-vdagent18.040.17.0-1ubuntu1vulnerable
Ubuntuspice-vdagent18.040.17.0-1ubuntu2vulnerable
Ubuntuspice-vdagent18.040.17.0-1ubuntu2.2vulnerable
Ubuntuspice-vdagent20.040.19.0-2vulnerable
Ubuntuspice-vdagent20.040.19.0-2ubuntu0.2vulnerable
Ubuntuspice-vdagent22.040.20.0-2build1vulnerable
Ubuntuspice-vdagent22.040.20.0-3vulnerable
Ubuntuspice-vdagent22.040.22.1-1vulnerable
Ubuntuspice-vdagent22.040.22.1-1ubuntu0.1fixed
Ubuntuspice-vdagent24.040.22.1-3vulnerable
Ubuntuspice-vdagent24.040.22.1-4vulnerable
Ubuntuspice-vdagent24.040.22.1-4build1vulnerable
Ubuntuspice-vdagent24.040.22.1-4build2vulnerable
Ubuntuspice-vdagent24.040.22.1-4build3vulnerable
Ubuntuspice-vdagent24.040.22.1-4ubuntu0.1fixed
Ubuntuspice-vdagent25.100.22.1-4.1vulnerable
Ubuntuspice-vdagent25.100.22.1-4.1ubuntu1vulnerable
Ubuntuspice-vdagent25.100.22.1-5vulnerable
Ubuntuspice-vdagent26.040.22.1-5vulnerable
Ubuntuspice-vdagent26.040.23.0-1vulnerable
Ubuntuspice-vdagent26.040.23.0-1ubuntu0.1fixed
Susespice-vdagentlinux enterprise server 16.00.22.1-160000.3.1fixed
Susespice-vdagentlinux enterprise server for sap applications 16.00.22.1-160000.3.1fixed
Susespice-vdagentlinux enterprise server for sap applications 12 sp50.16.0-8.13.2fixed
Susespice-vdagentlinux enterprise server 12 sp5-ltss0.16.0-8.13.2fixed
Susespice-vdagentlinux enterprise server ltss extended security 12 sp50.16.0-8.13.2fixed
Susespice-vdagentlinux enterprise module for desktop applications 15 sp70.22.1-150500.4.3.1fixed
Susespice-vdagentlinux enterprise high performance computing 15 sp5-espos0.22.1-150500.4.3.1fixed
Susespice-vdagentlinux enterprise high performance computing 15 sp5-ltss0.22.1-150500.4.3.1fixed
Susespice-vdagentlinux enterprise server 15 sp5-ltss0.22.1-150500.4.3.1fixed
Susespice-vdagentlinux enterprise server 15 sp6-ltss0.22.1-150500.4.3.1fixed
Susespice-vdagentlinux enterprise server for sap applications 15 sp50.22.1-150500.4.3.1fixed
Susespice-vdagentlinux enterprise server for sap applications 15 sp60.22.1-150500.4.3.1fixed
Susespice-vdagentlinux enterprise high performance computing 15 sp4-espos0.21.0-150300.3.6.1fixed
Susespice-vdagentlinux enterprise high performance computing 15 sp4-ltss0.21.0-150300.3.6.1fixed
Susespice-vdagentlinux enterprise server 15 sp4-ltss0.21.0-150300.3.6.1fixed
Susespice-vdagentlinux enterprise server for sap applications 15 sp40.21.0-150300.3.6.1fixed
Opensusespice-vdagentleap 16.00.22.1-160000.3.1fixed
Opensusespice-vdagenttumbleweed0.23.0-4.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspice-vdagentsourcesid0.23.0-3not yet assignedNot reported[1141318]
Debianspice-vdagentsourceforky0.23.0-3not yet assignedNot reported[1141318]
Debianspice-vdagentsourcetrixie(unfixed)not yet assignedNot reported[1141318]
Debianspice-vdagentsourcebookworm0.22.1-3+deb12u1not yet assignedNot reported[1141318]
Ubuntuspice-vdagentdebnoble0.22.1-4ubuntu0.1Not reportedNot reportedNot reported
Ubuntuspice-vdagentdeb22.040.22.1-1ubuntu0.1Not reportedUSN-8723-1Not reported
Ubuntuspice-vdagentdeb24.040.22.1-4ubuntu0.1Not reportedUSN-8723-1Not reported
Ubuntuspice-vdagentdeb26.040.23.0-1ubuntu0.1Not reportedUSN-8723-1Not reported
Ubuntuspice-vdagentdeb22.040.22.1-1ubuntu0.1Not reportedUBUNTU-CVE-2026-57965Not reported
Ubuntuspice-vdagentdeb24.040.22.1-4ubuntu0.1Not reportedUBUNTU-CVE-2026-57965Not reported
Ubuntuspice-vdagentdeb26.040.23.0-1ubuntu0.1Not reportedUBUNTU-CVE-2026-57965Not reported
Susespice-vdagentrpmlinux enterprise server 16.00.22.1-160000.3.1Not reportedSUSE-SU-2026:23109-1Not reported
Susespice-vdagentrpmlinux enterprise server for sap applications 16.00.22.1-160000.3.1Not reportedSUSE-SU-2026:23109-1Not reported
Susespice-vdagentrpmlinux enterprise server for sap applications 12 sp50.16.0-8.13.2Not reportedSUSE-SU-2026:3585-1Not reported
Susespice-vdagentrpmlinux enterprise server 12 sp5-ltss0.16.0-8.13.2Not reportedSUSE-SU-2026:3585-1Not reported
Susespice-vdagentrpmlinux enterprise server ltss extended security 12 sp50.16.0-8.13.2Not reportedSUSE-SU-2026:3585-1Not reported
Susespice-vdagentrpmlinux enterprise module for desktop applications 15 sp70.22.1-150500.4.3.1Not reportedSUSE-SU-2026:3485-1Not reported
Susespice-vdagentrpmlinux enterprise high performance computing 15 sp5-espos0.22.1-150500.4.3.1Not reportedSUSE-SU-2026:3485-1Not reported
Susespice-vdagentrpmlinux enterprise high performance computing 15 sp5-ltss0.22.1-150500.4.3.1Not reportedSUSE-SU-2026:3485-1Not reported
Susespice-vdagentrpmlinux enterprise server 15 sp5-ltss0.22.1-150500.4.3.1Not reportedSUSE-SU-2026:3485-1Not reported
Susespice-vdagentrpmlinux enterprise server 15 sp6-ltss0.22.1-150500.4.3.1Not reportedSUSE-SU-2026:3485-1Not reported
Susespice-vdagentrpmlinux enterprise server for sap applications 15 sp50.22.1-150500.4.3.1Not reportedSUSE-SU-2026:3485-1Not reported
Susespice-vdagentrpmlinux enterprise server for sap applications 15 sp60.22.1-150500.4.3.1Not reportedSUSE-SU-2026:3485-1Not reported
Susespice-vdagentrpmlinux enterprise high performance computing 15 sp4-espos0.21.0-150300.3.6.1Not reportedSUSE-SU-2026:3470-1Not reported
Susespice-vdagentrpmlinux enterprise high performance computing 15 sp4-ltss0.21.0-150300.3.6.1Not reportedSUSE-SU-2026:3470-1Not reported
Susespice-vdagentrpmlinux enterprise server 15 sp4-ltss0.21.0-150300.3.6.1Not reportedSUSE-SU-2026:3470-1Not reported
Susespice-vdagentrpmlinux enterprise server for sap applications 15 sp40.21.0-150300.3.6.1Not reportedSUSE-SU-2026:3470-1Not reported
Opensusespice-vdagentrpmleap 16.00.22.1-160000.3.1Not reportedOPENSUSE-SU-2026:21506-1Not reported
Opensusespice-vdagentrpmtumbleweed0.23.0-4.1Not reportedOPENSUSE-SU-2026:11379-1Not reported

[Debian bug #1141318]

Notes

[trixie] spice-vdagent: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [spice-vdagent]Affected
    Details (4)

    • 0.22.1-3+b2 · amd64 · bookworm

      Affected · Fixed: 0.22.1-3+deb12u1

      nvd · spice-vdagent · debian · bookworm; nvd · spice-vdagent · debian · 12

    • 0.22.1-3+b2 · arm64 · bookworm

      Affected · Fixed: 0.22.1-3+deb12u1

      nvd · spice-vdagent · debian · bookworm; nvd · spice-vdagent · debian · 12

    • 0.22.1-3+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 0.22.1-3+deb12u1

      nvd · spice-vdagent · debian · bookworm; nvd · spice-vdagent · debian · 12

    • 0.22.1-3+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 0.22.1-3+deb12u1

      nvd · spice-vdagent · debian · bookworm; nvd · spice-vdagent · debian · 12

[Debian 13 (Trixie)]

  • [spice-vdagent]Affected
    Details (2)

    • 0.22.1-4.1 · amd64 · trixie

      Affected

      nvd · spice-vdagent · debian · 13

    • 0.22.1-4.1 · arm64 · trixie

      Affected

      nvd · spice-vdagent · debian · 13

[openSUSE Tumbleweed]

  • [spice-vdagent]Fixed

    Source package: [spice-vdagent]

    Details (1)

    • 0.23.0-4.2 · x86_64 · tumbleweed

      Fixed · Fixed: 0.23.0-4.1

      nvd · spice-vdagent · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]