Spice-Space Spice-Vdagent
7 CVEs affecting Spice-Space Spice-Vdagent. Latest disclosed: 2026-06-29. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-15108 | High | 7.8 | 2018-01-20 | spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session th… |
CVE-2020-25651 | Medium | 6.4 | 2020-11-26 | A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate… |
CVE-2020-25653 | Medium | 6.3 | 2020-11-26 | A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest u… |
CVE-2020-25652 | Medium | 5.5 | 2020-11-26 | A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/… |
CVE-2020-25650 | Medium | 5.5 | 2020-11-25 | A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user wit… |
CVE-2026-57965 | Medium | 5.1 | 2026-06-29 | A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerabi… |
CVE-2026-57966 | Medium | 4.4 | 2026-06-29 | A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on t… |