This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-57965 →

DEBIAN-CVE-2026-57965

A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This...

Original description

The description as published by the source.

A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 spice-vdagent

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-3+deb12u1"}]}]

Debian:13 spice-vdagent

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 spice-vdagent

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-3"}]}]

References

advisory security-tracker.debian.org