See how xschem compares to other vendors in security performance
xschem 2.9.9 through 3.4.7 contains a heap out-of-bounds write vulnerability in readdataset() in src/rawtovcd.c due to an unchecked variable index. Attackers can supply a crafted ngspice .raw file that, when converted with rawtovcd, writes file-controlled heap pointers at chosen signed offsets, corrupting heap memory.
xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in readxschemfile() in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a "[" record, causing xschem to read and dereference memory below the instance array and crash.