Bug 2554021

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The GLZ encoder dictionary restore path in the SPICE server truncates a size_t allocation size to int when calling the GlzEncoderUsrContext::malloc callback. The client-controlled max_encoders value from migration data controls the allocation size via sizeof(uint32_t) * max_encoders.

On 64-bit systems, with a crafted max_encoders value (e.g., 0xC0000001), the product sizeof(uint32_t) * 0xC0000001 = 0x300000004 (size_t) is truncated to int value 4, causing g_malloc to allocate only 4 bytes. The subsequent reset loop (glz-encoder-dict.c lines 104-107) then writes 4 bytes per iteration for 0xC0000001 iterations into the 4-byte buffer, resulting in a massive heap buffer overflow (~12.88 GB write past the allocation).

Exploitation requires SPICE client authentication (ticket or SASL) and an active live migration window. The attacker sends a crafted SPICE_MSGC_MIGRATE_DATA on the display channel with a malicious max_encoders value in GlzEncDictRestoreData.

Upstream fix: https://gitlab.freedesktop.org/spice/spice/-/merge_requests/253 (merged 2026-10-09)