Red Hat Enterprise Linux GLZ encoder dictionary restore path max_encoders heap-based overflow

Summaryinfo

A vulnerability categorized as very critical has been discovered in Red Hat Enterprise Linux. Affected by this issue is some unknown functionality of the component GLZ encoder dictionary restore path. Such manipulation of the argument max_encoders leads to heap-based overflow. This vulnerability is listed as CVE-2026-105959. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Red Hat Enterprise Linux (affected version unknown) and classified as very critical. Affected by this issue is an unknown functionality of the component GLZ encoder dictionary restore path. The manipulation of the argument max_encoders with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.

The advisory is shared for download at access.redhat.com. This vulnerability is handled as CVE-2026-105959 since 10/06/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 10/16/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Red Hat

Name

• Enterprise Linux

License

• commercial

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion