Red Hat Security Advisory: spice-client-win security update
Affects Red Hat spice-client-winSource GCVE Database
Exploited in the wild · KEV due 27 May 2025 · 27% EPSS : apply the vendor's fix or mitigations to Red Hat spice-client-win now.
Data as of 26 Oct 2026, 12:55 UTC
Actively exploited
High severity · No CVSS score from NVD or the CNA
- KEV deadline
- US federal agencies must patch by this date; a sensible deadline for everyone else.
- EPSS
- 27.7% chance of exploitation in 30 days – higher than 98% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 28 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 22 days before disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
Added to CISA KEV (opens in a new tab)
exploitation confirmed
, 22 days before disclosure
KEV remediation due
US federal deadline
, 1 day before disclosure
CVE published
on cve.org
, t = 0
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Spice client MSI installers for Windows clients Security Fix(es): * freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files (CVE-2025-27363) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.