The GLZ encoder dictionary restore path in the SPICE server truncates a size_t allocation size to int when calling the GlzEncoderUsrContext::malloc callback. The client-controlled max_encoders value from migration data controls the allocation size via sizeof(uint32_t) * max_encoders.

On 64-bit systems, with a crafted max_encoders value (e.g., 0xC0000001), the product sizeof(uint32_t) * 0xC0000001 = 0x300000004 (size_t) is truncated to int value 4, causing g_malloc to allocate only 4 bytes. The subsequent reset loop (glz-encoder-dict.c lines 104-107) then writes 4 bytes per iteration for 0xC0000001 iterations into the 4-byte buffer, resulting in a massive heap buffer overflow (~12.88 GB write past the allocation).

Exploitation requires SPICE client authentication (ticket or SASL) and an active live migration window. The attacker sends a crafted SPICE_MSGC_MIGRATE_DATA on the display channel with a malicious max_encoders value in GlzEncDictRestoreData.

Upstream fix: https://gitlab.freedesktop.org/spice/spice/-/merge_requests/253 (merged 2026-10-09)