CVE-2026-105959 Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
A malicious authenticated SPICE client can trigger a heap buffer overflow via integer truncation during VM live migration, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-105959?
CVE-2026-105959 is a high-severity vulnerability in Red Hat Enterprise Linux 6, published on 16 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
Weakness: CWE-190
Which versions are affected by CVE-2026-105959?
How do I fix CVE-2026-105959?
Apply the vendor's patch.
Is CVE-2026-105959 being exploited?
There is no known exploitation of CVE-2026-105959 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-105959, DEBIAN-CVE-2026-105959, GHSA-m5f2-676c-jfj7, UBUNTU-CVE-2026-105959.