A flaw in spice-server's GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback. A malicious authenticated SPICE client can exploit this during VM live migration by sending a crafted max_encoders value, causing a massive heap buffer overflow that can lead to arbitrary code execution or denial of service.

The vulnerability affects Red Hat Enterprise Linux 6, 7, and 8 systems running spice-server. The specific versions of spice-server are not enumerated in the advisory, so any installed instance on those operating systems is potentially affected.

The CVSS score of 7.5 indicates a high severity level, and the EPSS score is not available, implying that the exploitation likelihood is not quantified but remains a concern due to the nature of the flaw. The attack vector is limited to authenticated SPICE clients during live migration, and the vulnerability is not listed in CISA KEV. Successful exploitation could result in remote code execution or service disruption.