CVE-2026-105959 in Red Hat
Summary
by MITRE • 10/16/2026
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within spice-server represents a critical integer conversion flaw located specifically within the GLZ encoder dictionary restore path. This component is responsible for handling compression and encoding parameters during virtual machine operations, particularly those involving live migration between hosts. The core technical defect arises from an improper type casting operation where a variable of type size_t, which is designed to hold large unsigned integers representing memory allocation sizes, is truncated down to an int data type before being passed to the malloc callback function. On many system architectures, particularly 64-bit systems, the int type has a maximum value significantly lower than that of size_t. This truncation means that if the original allocated size exceeds the positive range limit of a signed integer, typically two gigabytes on most modern platforms, the resulting truncated value will be interpreted as a much smaller number or potentially wrap around to a negative value depending on implementation specifics.
This architectural mismatch creates a severe security risk during VM live migration scenarios where an authenticated SPICE client can interact with the server's encoding parameters. By sending a crafted max_encoders value within the migration data stream, an attacker can manipulate the internal state of the GLZ encoder dictionary restoration process. Because the system trusts this input to determine memory allocation boundaries without adequate validation against integer overflow or truncation limits, it proceeds to allocate heap memory based on the truncated size rather than the intended large size. This discrepancy leads directly to a massive heap buffer overflow condition where subsequent write operations exceed the bounds of the allocated buffer space.
The operational impact of this vulnerability is substantial as it allows for arbitrary code execution with the privileges of the spice-server process, which typically runs under elevated permissions to manage virtual machine resources. An attacker who has authenticated access to the SPICE service can exploit this flaw to corrupt adjacent heap metadata or inject malicious shellcode into memory structures. This exploitation vector is particularly dangerous in cloud computing and enterprise virtualization environments where live migration is a standard operational procedure for load balancing and maintenance. The ability to trigger such an overflow remotely via network traffic makes it a high-severity threat that can lead to complete compromise of the host system hosting the vulnerable spice-server instance.
From a classification perspective, this vulnerability aligns with CWE-197, which defines numeric truncation errors, specifically involving the loss of information when converting from a larger integer type to a smaller one without proper bounds checking. Furthermore, it relates closely to CWE-400 regarding uncontrolled resource consumption and potentially CWE-787 if the overflow leads to out-of-bounds writes that facilitate code execution. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw supports techniques associated with memory corruption exploitation, which are often leveraged in conjunction with privilege escalation tactics following initial access through authenticated services like SPICE.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary remediation involves updating spice-server to a version that includes patches for the GLZ encoder dictionary restore path, ensuring that size_t values are validated against integer limits before being cast or used in memory allocation calls. Developers should implement strict input validation checks that verify whether the incoming max_encoders value fits within safe bounds compatible with the target data type. Additionally, enabling compiler flags such as -ftrapv for GCC/Clang can help detect signed integer overflows at runtime during development and testing phases. Security teams should also enforce least privilege principles by isolating spice-server processes from critical system resources to limit the blast radius of any potential exploitation attempts until patches are fully deployed across all virtualization hosts.