Critical Vulnerabilities in SPICE vdagent Affecting Ubuntu Systems

Two significant vulnerabilities were discovered in SPICE vdagent, affecting Ubuntu systems. CVE-2026-57965 involves an integer overflow that could lead to a denial of service, allowing a malicious SPICE host to crash the vdagent. CVE-2026-57966 pertains to improper sanitization of filenames during file transfers, enabling arbitrary file writes on the guest OS with the process's privileges. Both vulnerabilities were published on June 29, 2026, and can be exploited by compromised SPICE hosts. Users are advised to update their systems to mitigate these risks. The vulnerabilities require a restart of the spice-vdagent after applying updates. Ubuntu Pro offers extended security coverage for affected packages.

Key Points: • Two critical vulnerabilities in SPICE vdagent identified: CVE-2026-57965 and CVE-2026-57966. • CVE-2026-57965 can lead to denial of service, while CVE-2026-57966 allows arbitrary file writes. • Users must update and restart spice-vdagent to protect against these vulnerabilities.