CVE-2020-25652: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to the spice-vdagentd daemon, resulting in a denial of service. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and prior.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Spice-Space Spice-Vdagent: up to and including 0.20.0

Published 2020-11-26. Last modified 2026-06-17.