CVE-2026-105959

Name	CVE-2026-105959
Description	A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
spice (PTS)	bookworm	0.15.1-1	vulnerable
	trixie	0.15.2-1	vulnerable
	forky, sid	0.16.0-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
spice	source	(unstable)	(unfixed)

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2554008
https://gitlab.freedesktop.org/spice/spice/-/merge_requests/253
https://gitlab.freedesktop.org/spice/spice/-/commit/a3b9feb121fa6b19dc55cca6ec546e35fe4c9573
https://gitlab.freedesktop.org/spice/spice/-/commit/4807b923d09e656d3f414ccde16d83189ba79ac9