Vulnerability Details CVE-2026-57965
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 2.0%
CVSS Severity
CVSS v3 Score 5.1
References
Products affected by CVE-2026-57965
-
cpe:2.3:a:spice-space:spice-vdagent:-
-
cpe:2.3:o:redhat:enterprise_linux:10.0
-
cpe:2.3:o:redhat:enterprise_linux:6.0
-
cpe:2.3:o:redhat:enterprise_linux:7.0
-
cpe:2.3:o:redhat:enterprise_linux:8.0