CVE-2016-0749

What it actually does

Heap-based buffer overflow in SPICE smartcard handling that crashes the QEMU-KVM process or permits arbitrary code execution on guest VM connection.

Why it matters to the business

Virtual machine hosts can be crashed or fully compromised, causing widespread service outages and potential data exposure in virtualized environments.

How an attack unfolds

An attacker initiates a SPICE connection to a guest VM, supplies malicious smartcard data that triggers the overflow, and either crashes the process or gains code execution on the host.

How to fix it

Upgrade ghostscript to the fixed versions listed for each Debian release (9.22~dfsg-1 or newer) on Debian 10, 11, 12, and 13.

How to confirm the fix worked

Confirm the installed ghostscript package version meets or exceeds the fixed release for the running Debian distribution.

Typical attack path

1. Connect to a guest VM over SPICE
2. Send crafted smartcard interaction vectors
3. Trigger heap buffer overflow
4. Crash process or execute arbitrary code

How to detect it

Search QEMU and SPICE logs for unexpected crashes or anomalous smartcard connection attempts around the time of suspected incidents.

What your security team should do

• Apply the listed ghostscript package upgrades on all affected Debian systems
• Review virtualized workloads for continued exposure to legacy SPICE configurations