CVE-2026-57964

A flaw was found in spice-vdagent. On macOS and BSD platforms, an unprivileged local user can bypass authentication by connecting to the Unix Domain Socket Client/Server (UDSCS) socket. This allows the unauthorized user to receive host-to-guest messages, including clipboard data and file transfers, inject clipboard data to the SPICE host, and prevent the legitimate agent from functioning.

Red Hat products are not affected by this CVE as the vulnerable code is not present in Red Hat's shipped versions of spice-vdagent.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.