CVE-2020-14355

Severity: medium (CVSS 6.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-07 · updated 2026-06-17
Weakness: CWE-120

Description

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 20.04
Debian Linux: 9.0
openSUSE Leap: 15.2
Red Hat Enterprise Linux: 6.0, 7.0, 8.0
RedHat Enterprise Linux Aus: 8.2
RedHat Enterprise Linux Eus: 8.1
RedHat Enterprise Linux Tus: 8.2
RedHat Enterprise Linux Update Services For Sap Solutions: 8.0
OpenStack: 16.1
The SPICE Project spice: before 0.14.2 — fixed in 0.14.2

How to fix

Upgrade to a fixed version: The SPICE Project spice 0.14.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-14355 or the next vulnerability affects your stack