{"id":"CVE-2026-128990","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-128990","summary":"xschem 2.9.9 through 3.4.7 Heap Out-of-Bounds Write via rawtovcd read_dataset()","details":"xschem 2.9.9 through 3.4.7 contains a heap out-of-bounds write vulnerability in read_dataset() in src/rawtovcd.c due to an unchecked variable index. Attackers can supply a crafted ngspice .raw file that, when converted with rawtovcd, writes file-controlled heap pointers at chosen signed offsets, corrupting heap memory.","published":"2026-11-13T15:01:43.598Z","modified":"2026-11-15T07:03:31.648974368Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/StefanSchippers/xschem/commit/e29af39c6133c36bdaf66603fd663231e75517f1","label":"StefanSchippers/xschem@e29af39"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128990.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128990"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/xschem-2.9.9-through-3.4.7-heap-out-of-bounds-write-via-rawtovcd-read-dataset"},{"type":"FIX","url":"https://github.com/StefanSchippers/xschem/commit/e29af39c6133c36bdaf66603fd663231e75517f1"},{"type":"PACKAGE","url":"https://github.com/StefanSchippers/xschem"},{"type":"ARTICLE","url":"https://github.com/StefanSchippers/xschem/blob/3.4.7/src/rawtovcd.c#L124-L148"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-15T07:03:31.648974368Z"}}