Executive brief
A vulnerability exists in the SPICE agent, a tool used to improve the user experience in virtual machines by enabling features like clipboard sharing and file transfers. A compromised or malicious host server can send a specially crafted message to the virtual machine, causing the agent to crash. This results in a denial of service for the virtual machine's integration features, though it typically requires the host server to already be compromised.
Technical details
An integer overflow vulnerability exists in the udscs_write() function within src/udscs.c of spice-vdagent. The function calculates a buffer size using 32-bit unsigned integers (guint) without proper bounds checking; specifically, when a large 'size' value is provided in a VDAgentMessage (such as clipboard or file transfers), the calculation wraps around to a small value. This leads to a heap buffer overflow during a subsequent memcpy operation. While the attack vector is local to the guest, it is triggered by the SPICE host. Exploitation results in a SIGBUS crash of the spice-vdagent daemon, causing a Denial of Service (DoS) for guest-host integration features. The vulnerability is confirmed via AddressSanitizer.
Affected products
- Red Hat Red Hat Enterprise Linux 6 affected status
- Red Hat Red Hat Enterprise Linux 7 affected status
- Red Hat Red Hat Enterprise Linux 8 affected status
- Red Hat Red Hat Enterprise Linux 9 affected status
- Red Hat Red Hat Enterprise Linux 10 affected status
- SPICE Project spice-vdagent
Timeline
- 2026-06-26: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-29: advisory: CVE published to NVD dataset