CVE-2026-105959: Integer Overflow or Wraparound in Red Hat Red Hat Enterprise Linux 6

The vulnerability in spice-server arises from the GLZ encoder dictionary restore path truncating a size_t allocation size to an int when invoking the malloc callback. This truncation can lead to an integer overflow or wraparound, enabling a malicious authenticated SPICE client to cause a massive heap buffer overflow during virtual machine live migration by sending a specially crafted max_encoders value within migration data.

Successful exploitation could result in a heap buffer overflow, potentially leading to arbitrary code execution, denial of service, or other impacts affecting confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score of 7.5 reflects high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

The vendor advisory from Red Hat should be consulted for the current patch or remediation status. Since no explicit patch or remediation information is provided in the input, patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-105959 for current remediation guidance.