Is CVE-2026-105959 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105959 being exploited in the wild.

How severe is CVE-2026-105959?

High severity, with a CVSS score of 7.5, published 16 October 2026.

Which products and versions are affected?

Freedesktop.Org SPICE server prior to fix.

How is CVE-2026-105959 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-105959?

Check whether you run Freedesktop.Org SPICE server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105959: SPICE server heap buffer overflow in GLZ encoder

CVE-2026-105959 · Severity: high · CVSS 7.5 · Published 2026-10-16

SPICE server, which handles graphics compression for virtual machine remote access, contains a heap buffer overflow vulnerability in its GLZ compression encoder. A malicious SPICE client with valid credentials can exploit this flaw during VM live migration by sending a crafted value, potentially allowing arbitrary code execution and complete compromise of the virtualization host or guest system.

Vendors: Freedesktop.Org.

Quick answers

Is CVE-2026-105959 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105959 being exploited in the wild.
How severe is CVE-2026-105959?: High severity, with a CVSS score of 7.5, published 16 October 2026.
Which products and versions are affected?: Freedesktop.Org SPICE server prior to fix.
Is there a fix for CVE-2026-105959?: No fixed version is recorded yet. Disable VM live migration if not required to eliminate the attack surface. If live migration is necessary, restrict SPICE client connections to trusted networks using firewall rules and enforce strong authentication via TLS with mutual certificate validation or SASL with strong credentials. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105959 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-105959?: Check whether you run Freedesktop.Org SPICE server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable VM live migration if not required to eliminate the attack surface. If live migration is necessary, restrict SPICE client connections to trusted networks using firewall rules and enforce strong authentication via TLS with mutual certificate validation or SASL with strong credentials.

Technical details

An integer truncation flaw in the GLZ encoder's dictionary restore path converts a size_t allocation size to int before passing it to malloc, allowing heap buffer overflow. The vulnerability is exploitable only by an authenticated SPICE client during VM live migration when sending specially crafted max_encoders values in migration data. A successful exploit grants an attacker memory corruption capabilities leading to code execution.

Affected products

freedesktop.org SPICE server prior to fix

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.