# CVE-2026-105958: Spice-server: spice: heap oob read/write via unchecked migration data offsets Status: published. Published: 2026-10-16. Updated: 2026-11-04. A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer. ## Remediation - workaround: This vulnerability is only exploitable during VM live migration by an authenticated SPICE client. If live migration is not required, disabling it eliminates the attack surface. If live migration is needed, restrict SPICE client connections to trusted networks using firewall rules and enforce strong authentication (TLS with mutual certificate validation, or SASL with strong credentials) to limit who can connect as a SPICE client. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce strict bounds validation on client-supplied offsets and buffer lengths across all SPICE migration data handlers prior to memory operations: upgrade to the fixed Spice/Spice Server builds, which validate migration data offsets and read bounds against declared message lengths instead of reallocating from attacker-controlled values, closing all 4 injection vectors (RedCharDevice restore via write_data_ptr offset manipulation, smartcard restore via read_data_ptr offset manipulation, reds agent state restore via msg_header_ptr offset manipulation, DisplayChannelClient migrate data handling via surfaces_at_client_ptr offset manipulation). Until patched, this is a concern on Linux hosts running Spice Server with VM live migration enabled, so disable VM live migration if not required, restrict SPICE client network access using firewall rules, and enforce strong authentication via SASL or mutual TLS. As a compensating measure, randomize heap and binary addresses using ASLR to impede reliable exploitation of out-of-bounds reads and writes, enforce full RELRO and PIE to make Global Offset Table entries read-only and prevent control flow diversion via heap corruption, validate indirect call targets using Control Flow Integrity or shadow call stacks to block redirection upon corruption of function pointers or vtables, enable FORTIFY_SOURCE to detect buffer overflows during memory copy operations such as memcpy and abort execution, and confine the SPICE server process using SELinux in enforcing mode to restrict host access if arbitrary code execution occurs. These controls limit blast radius and contain exploitation, but they do not fix the underlying unchecked migration data offsets defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium) (source: CNA: redhat) ## Affected products and versions - Red Hat / Red Hat Enterprise Linux 6 (spice-server): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 7 (spice): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 8 (spice): Version range not reported. Source: CNA: redhat ## Severity and prioritization - CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: redhat - CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; source: NVD: secalert@redhat.com - CISA KEV: No listing in collected sources - EPSS: 0.25% as of 2026-11-04; percentile 15.99% - SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP - Weaknesses: CWE-787 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://access.redhat.com/security/cve/CVE-2026-105958 (CNA: redhat; vdb-entry, x_refsource_REDHAT) - https://gitlab.freedesktop.org/spice/spice/-/merge_requests/257 (CNA: redhat) - https://access.redhat.com/security/cve/CVE-2026-105958 (secalert@redhat.com) - https://gitlab.freedesktop.org/spice/spice/-/merge_requests/257 (secalert@redhat.com) ## Provenance - CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-105958; retrieved 2026-11-04; source updated 2026-11-04 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105958; retrieved 2026-11-05; source updated 2026-11-04 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-105958; retrieved 2026-11-04; source updated Not reported Revision: 162f35613dad28e99a7ec9785605a901739545073413cefac3e97ec681023bca Canonical: https://y2.dev/cve/CVE-2026-105958 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.