The vulnerability resides in spice‑vdagent, where the filename supplied by a SPICE host during file transfer is used without proper sanitization. This flaw permits a malicious or compromised SPICE host to write arbitrary files to any location on the guest OS. The primary effect is remote write access, which can compromise confidentiality and integrity by installing malicious code or modifying critical files. The weakness is a classic File Path Manipulation (CWE‑22).

Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10 include the affected spice‑vdagent component. Systems that run these distributions and have the SPICE client enabled are vulnerable. No other vendors or products are listed in the CVE entry.

The CVSS score of 4.4 indicates moderate severity. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting limited observed exploitation so far. However, exploitation requires the SPICE host to be untrusted or compromised; a malicious host could use the file transfer capability to write files with the privileges of the spice‑vdagent process, typically the logged‑in user. This creates a potential for privilege escalation, code execution, or sabotage if the guest runs with elevated privileges.