A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.
CVSS Details
- CVSS 3.1 Base Score: 5.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade spice-vdagent-debuginfoUpgrade spice-vdagent-debugsourceUpgrade spice-vdagent | Aug 18, 2026 | Jun 29, 2026 |
| Debian | — | Upgrade spice-vdagent | Jul 26, 2026 | Jul 26, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | May 27, 2026 |
| Ubuntu | — | Upgrade spice-vdagent | Sep 14, 2026 | Sep 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub