CVE-2020-25653: Debian Linux

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Spice-Space Spice-Vdagent: up to and including 0.20.0

Published 2020-11-26. Last modified 2026-06-17.