Bug 2554008 (CVE-2026-105959)

Summary: CVE-2026-105959 spice-server: spice: Heap buffer overflow via GLZ dictionary max_encoders integer truncation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2554021    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-16 10:24:03 UTC 
The GLZ encoder dictionary restore path in the SPICE server truncates a size_t allocation size to int when calling the GlzEncoderUsrContext::malloc callback. The client-controlled max_encoders value from migration data controls the allocation size via sizeof(uint32_t) * max_encoders.

On 64-bit systems, with a crafted max_encoders value (e.g., 0xC0000001), the product sizeof(uint32_t) * 0xC0000001 = 0x300000004 (size_t) is truncated to int value 4, causing g_malloc to allocate only 4 bytes. The subsequent reset loop (glz-encoder-dict.c lines 104-107) then writes 4 bytes per iteration for 0xC0000001 iterations into the 4-byte buffer, resulting in a massive heap buffer overflow (~12.88 GB write past the allocation).

Exploitation requires SPICE client authentication (ticket or SASL) and an active live migration window. The attacker sends a crafted SPICE_MSGC_MIGRATE_DATA on the display channel with a malicious max_encoders value in GlzEncDictRestoreData.

Upstream fix: https://gitlab.freedesktop.org/spice/spice/-/merge_requests/253 (merged 2026-10-09)