CVE-2026-105959 Red Hat CVE debrief

Who should care

Defenders responsible for VM live migration environments using spice-server should assess exposure and potential impact. They should prioritize verifying exposure and assessing potential impact, especially in environments using spice-server for VM live migration. The issue affects spice-server, which is used in VM live migration environments.

Why it matters

CVE-2026-105959 is rated High with a CVSS score of 7.5. Defenders should prioritize verifying exposure and assessing potential impact, especially in environments using spice-server for VM live migration.

• Potential for heap buffer overflow during VM live migration
• Possible disruption of VM live migration process
• Need for verification of spice-server usage and exposure

Technical summary

The GLZ encoder dictionary restore path in spice-server truncates a size_t allocation size to int when calling the malloc callback. This allows a malicious authenticated SPICE client to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data. The vulnerability affects spice-server, which is used in VM live migration environments. The issue was reported by the Red Hat security team and fixed in a merge request. Defenders should prioritize verifying exposure and assessing potential impact, especially in environments using spice-server for VM live migration.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, especially in environments using spice-server for VM live migration.

Recommended defensive actions

• Verify exposure by checking if spice-server is used in environments with VM live migration
• Assess potential impact by evaluating the CVSS score and vector
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. The Red Hat security team reported the issue, and it was fixed in a spice-server merge request. Defenders should verify exposure and assess potential impact, especially in environments using spice-server for VM live migration. The CVE record was published on 2026-10-16T12:16:31.733Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.