Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
No PoCs found on GitHub currently.