debian/spice vulnerabilities

Latest debian/spice CVEs

Newest publication first · page 1 of 2

1. CVE-2026-105958 Spice-server: spice: heap oob read/write via unchecked migration data offsets

   Published 2026-10-16

   High·CVSS 7.5 EPSS 0.25%

   A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap c...

2. CVE-2026-105959 Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

   Published 2026-10-16

   High·CVSS 7.5 EPSS 0.48%

   A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a cr...

3. CVE-2020-23793 An issue was discovered in spice-server spice-server-0.14.0-6.el7_6.1.x86_64 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization.....

   Published 2023-08-22

   High·CVSS 8.6 EPSS 0.84%

   An issue was discovered in spice-server spice-server-0.14.0-6.el7_6.1.x86_64 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be other other effects.

4. CVE-2021-20201 A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a sin...

   Published 2021-05-28

   Medium·CVSS 5.3 EPSS 2.5%

   A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection.

5. DLA-2427-1 spice - security update

   Published 2020-11-01

   Unknown

6. DSA-4771-1 spice - security update

   Published 2020-10-11

   Unknown

7. CVE-2020-14355 Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affec...

   Published 2020-10-07

   Medium·CVSS 6.6 EPSS 2.7%

   Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send speci...

8. CVE-2019-3813 Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-executio...

   Published 2019-02-04

   High·CVSS 7.5 EPSS 1.2%

   Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.

9. DLA-1649-1 spice - security update

   Published 2019-01-30

   Unknown

10. DSA-4375-1 spice - security update

    Published 2019-01-29

    Unknown

11. DSA-4319-1 spice - security update

    Published 2018-10-15

    Unknown

12. DLA-1486-1 spice - security update

    Published 2018-08-31

    Unknown

13. CVE-2018-10873 A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authenticati...

    Published 2018-08-17

    High·CVSS 8.8 EPSS 3.9%

    A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a cr...

14. CVE-2016-9578 A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to c...

    Published 2018-07-27

    High·CVSS 7.5 EPSS 2.5%

    A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.

15. CVE-2016-9577 A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a...

    Published 2018-07-27

    High·CVSS 8.8 EPSS 3.8%

    A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.

16. CVE-2017-7506 spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacker to the spice server resulting into crash and/or server m...

    Published 2017-07-18

    High·CVSS 8.8 EPSS 4.2%

    spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacker to the spice server resulting into crash and/or server memory leak.

17. DSA-3907-1 spice - security update

    Published 2017-07-11

    Unknown

18. DLA-825-1 spice - security update

    Published 2017-02-17

    Unknown

19. DSA-3790-1 spice - security update

    Published 2017-02-16

    Unknown

20. DLA-531-1 spice - security update

    Published 2016-06-27

    Unknown

21. CVE-2016-2150 SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.

    Published 2016-06-09

    High·CVSS 7.1 EPSS 0.36%

    SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.

22. CVE-2016-0749 The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, whi...

    Published 2016-06-09

    Critical·CVSS 9.8 EPSS 8.5%

    The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.

23. CVE-2015-5261 Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

    Published 2016-06-07

    High·CVSS 7.1 EPSS 0.47%

    Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

24. CVE-2015-5260 Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host vi...

    Published 2016-06-07

    High·CVSS 7.8 EPSS 0.55%

    Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter.

25. DSA-3596-1 spice - security update

    Published 2016-06-06

    Unknown

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.