CVE-2020-25650: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Spice-Space Spice-Vdagent: up to and including 0.20.0

Published 2020-11-25. Last modified 2026-06-17.