A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1793290733 advisory.

  - A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from     SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE     client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds     read and write operations on the message buffer. (CVE-2026-105958)

  - A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation     size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM     live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in     migration data. (CVE-2026-105959)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4030 advisory.

    A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from     SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE     client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds     read and write operations on the message buffer. (CVE-2026-105958)

    A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation     size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM     live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in     migration data. (CVE-2026-105959)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation     size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM     live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in     migration data. (CVE-2026-105959)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375207	CentOS Linux 7 [TuxCare] Security Update: spice-server / spice-server-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1793290733)	Nessus	CentOS Local Security Checks	Local	high
371783	Amazon Linux 2 : spice (ALAS-2026-4030)	Nessus	Amazon Linux Local Security Checks	Local	high
366474	Linux Distros Unpatched Vulnerability : CVE-2026-105959	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-105959

high

Tenable Plugins

high

high

high