Hi,

The following vulnerability was published for spice-vdagent.

CVE-2026-57965[0]:
| A flaw was found in spice-vdagent. A malicious or compromised SPICE
| host can trigger an integer overflow by sending a specially crafted
| message. This vulnerability can lead to a heap buffer overflow,
| causing the spice-vdagent daemon to crash and resulting in a Denial
| of Service (DoS) for the virtual machine. This issue requires the
| SPICE host to be untrusted or compromised for exploitation.

https://bugzilla.redhat.com/show_bug.cgi?id=2493581


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-57965
https://www.cve.org/CVERecord?id=CVE-2026-57965

Please adjust the affected versions in the BTS as needed.

fixed 1141318 0.23.0-3
fixed 1141317 0.23.0-3
thanks


I've prepared an update and uploaded to archive fixing CVE-2026-57965
and CVE-2026-57966 but missed to tag bug number in d/changelog.