Linuxsecurity Critical Vulnerabilities in SPICE vdagent Affecting Ubuntu Systems
Article Content
- •Two critical vulnerabilities in SPICE vdagent identified: CVE-2026-57965 and CVE-2026-57966.
- •CVE-2026-57965 can lead to denial of service, while CVE-2026-57966 allows arbitrary file writes.
- •Users must update and restart spice-vdagent to protect against these vulnerabilities.
Two significant vulnerabilities were discovered in SPICE vdagent, affecting Ubuntu systems. CVE-2026-57965 involves an integer overflow that could lead to a denial of service, allowing a malicious SPICE host to crash the vdagent. CVE-2026-57966 pertains to improper sanitization of filenames during file transfers, enabling arbitrary file writes on the guest OS with the process's privileges. Both vulnerabilities were published on June 29, 2026, and can be exploited by compromised SPICE hosts. Users are advised to update their systems to mitigate these risks. The vulnerabilities require a restart of the spice-vdagent after applying updates. Ubuntu Pro offers extended security coverage for affected packages.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Ubuntu and CVE-2026-57965 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed