Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4030
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer. (CVE-2026-105958)
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration data. (CVE-2026-105959)
Affected Packages:
spice
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update spice or yum update --advisory ALAS2-2026-4030 to update your system.
src:
spice-0.14.0-10.amzn2.src
x86_64:
spice-server-0.14.0-10.amzn2.x86_64
spice-server-devel-0.14.0-10.amzn2.x86_64
spice-debuginfo-0.14.0-10.amzn2.x86_64