CVE-2026-128991: xschem 2.9.9 through 3.4.7 Out-of-Bounds Read via read_xschem_file() Embedded-Symbol Record
xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in readxschemfile() in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a "[" record, causing xschem to read and dereference memory below the instance array and crash.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of xschem versions 2.9.9 through 3.4.7 are exposed when they open a crafted schematic file. Exploitation requires local attack vector conditions and user interaction.
What does an attacker need to include in a malicious schematic?
The crafted schematic must begin with a "[" embedded-symbol record that has no preceding instance. This causes read_xschem_file() to access memory below the instance array and can crash xschem.
What is the impact of successful exploitation?
The reported effect is a crash caused by an out-of-bounds read and invalid memory dereference. The supplied severity vector indicates no confidentiality impact, low integrity impact, and high availability impact.