Packages
- spice-vdagent - Spice agent for Linux
Details
It was discovered that SPICE vdagent had an integer overflow in the buffer
size calculation used when writing to the daemon socket. A malicious or
compromised SPICE host could possibly use this issue to cause SPICE vdagent
to crash, resulting in a denial of service. (CVE-2026-57965)
It was discovered that SPICE vdagent did not properly sanitize filenames
provided by the SPICE host during file transfers. A malicious or
compromised SPICE host could possibly use this issue to write arbitrary
files to any location on the guest operating system with the privileges of
the spice-vdagent process. (CVE-2026-57966)
It was discovered that SPICE vdagent had an integer overflow in the buffer
size calculation used when writing to the daemon socket. A malicious or
compromised SPICE host could possibly use this issue to cause SPICE vdagent
to crash, resulting in a denial of service. (CVE-2026-57965)
It was discovered that SPICE vdagent did not properly sanitize filenames
provided by the SPICE host during file transfers. A malicious or
compromised SPICE host could possibly use this issue to write arbitrary
files to any location on the guest operating system with the privileges of
the spice-vdagent process. (CVE-2026-57966)
Update instructions
After a standard system update you need to restart spice-vdagent to make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 26.04 LTS resolute | spice-vdagent – 0.23.0-1ubuntu0.1 | ||
| 24.04 LTS noble | spice-vdagent – 0.22.1-4ubuntu0.1 | ||
| 22.04 LTS jammy | spice-vdagent – 0.22.1-1ubuntu0.1 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.