CVE-2026-105958: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux 6

The vulnerability in spice-server arises because multiple migration data handlers process client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without proper bounds checking. An authenticated SPICE client can exploit this during virtual machine live migration to read arbitrary heap memory or cause heap corruption through out-of-bounds read and write operations on the message buffer. This flaw affects Red Hat Enterprise Linux 6. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high privileges required, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows a malicious authenticated SPICE client to read arbitrary heap memory or corrupt heap memory during VM live migration. This can lead to disclosure of sensitive information, compromise of data integrity, and potential denial of service or further code execution within the affected virtual machine environment.

The vendor advisory from Red Hat should be consulted for remediation status. No explicit patch or fix information is provided in the input data. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-105958 for current remediation guidance.