A flaw in spice-server allows unvalidated offsets supplied by a SPICE client in migration data messages to lead to out‑of‑bounds read and write operations on the server’s heap buffer. This can cause arbitrary heap memory reads or heap corruption when a live migration is performed. The CVE does not explicitly state that code execution or privilege escalation is achieved, only that memory can be read or corrupted.

The vulnerability affects Red Hat Enterprise Linux 6, 7 and 8 through the spice‑server component that ships with these distributions. No specific patch version is listed; any installation of spice‑server that has not incorporated the mitigations described in the workaround is considered vulnerable.

The CVSS score of 7.5 indicates a high severity, but no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation to date. An attacker would need an authenticated SPICE client during a VM live migration to exploit the flaw. Under those conditions, the unchecked offsets can be used to read or write arbitrary heap data, which may result in heap corruption or denial of service on the host running the virtualization system.