Red Hat Product Security issued an advisory (RHSA-2026:0001) for spice-client-win MSI installers on Windows clients, addressing four vulnerabilities: CVE-2025-6965 (SQLite integer truncation), CVE-2025-8176 (libtiff use-after-free), CVE-2025-9900 (libtiff write-what-where), and CVE-2025-59375 (libexpat large memory allocation via crafted XML). These vulnerabilities affect Red Hat Enterprise Linux 8.8 and related update services. The advisory includes updated packages to remediate these issues. No CVSS base scores are provided in the advisory, but Red Hat rates the overall impact as Important. The advisory references detailed CVE pages for further information. No known exploits are reported in the wild. The vendor provides instructions for applying the update and package details with SHA-256 hashes.

The vulnerabilities fixed in this advisory could allow attackers to cause memory corruption (use-after-free, write-what-where), integer truncation errors, or trigger excessive memory allocation via crafted inputs. Such issues can potentially lead to denial of service or other unintended behavior in the affected spice-client-win components. The overall security impact is rated Important by Red Hat. No known active exploitation has been reported.

Red Hat has released updated spice-client-win packages for Red Hat Enterprise Linux 8.8 and related update services that address these vulnerabilities. Users should apply these official updates as described in the Red Hat advisory (RHSA-2026:0001) and the referenced article https://access.redhat.com/articles/11258 to remediate the issues. Since patches are available, applying the updates is the recommended mitigation. No additional vendor guidance indicates that other mitigations or workarounds are necessary.