An integer overflow in spice‑vdagent’s udscs_write() can be triggered by a specially crafted message sent by a SPICE host. The overflow corrupts heap memory, causing the spice‑vdagent daemon to crash and rendering the virtual machine unavailable. The flaw is a CWE‑190 integer‑overflow error and presents a moderate severity denial of service risk to the guest system.

Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are affected, as the vulnerable spice‑vdagent package is shipped with all these distributions.

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is available, so the probability of exploitation at this time is uncertain. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious or compromised SPICE host; the attacker must control or influence the host that communicates with the guest to trigger the overflow.