CVE-2026-128990: xschem 2.9.9 through 3.4.7 Heap Out-of-Bounds Write via rawtovcd read_dataset()
xschem 2.9.9 through 3.4.7 contains a heap out-of-bounds write vulnerability in readdataset() in src/rawtovcd.c due to an unchecked variable index. Attackers can supply a crafted ngspice .raw file that, when converted with rawtovcd, writes file-controlled heap pointers at chosen signed offsets, corrupting heap memory.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users or systems that run rawtovcd on ngspice .raw files are exposed when those files may be attacker-controlled or otherwise untrusted. The attack requires local processing of the crafted file rather than a network request.
What is required for exploitation?
An attacker must provide a crafted ngspice .raw file and have it converted with rawtovcd. The vulnerability has user interaction requirements, so a user or workflow must process the malicious file.
How can I determine whether my installation is affected?
Installations of xschem from version 2.9.9 through 3.4.7 are affected. Check both the installed xschem version and whether rawtovcd is used to convert .raw files.