CVE-2026-128990 · Package
NO FIX YET · SEE WHAT TO DO
xschem's rawtovcd tool has an unchecked index in read_dataset() that lets a crafted ngspice .raw file write attacker-chosen pointers past a heap buffer. An attacker who gets a team to convert such a file can corrupt heap memory, which can lead to code execution.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run xschem 2.9.9 through 3.4.7 and convert ngspice .raw files with rawtovcd, especially on files from untrusted sources. Users who never run rawtovcd on outside files have much less exposure.
Not affected if no-rawtovcd-use, trusted-input-only
Who cares eda, electronics-design, ngspice, xschem
xschem --version, and see whether it falls in 2.9.9 through 3.4.7.3.4.7, the last affected version in the sources; the fixed version is not stated in the sources.xschem 2.9.9 through 3.4.7 contains a heap out-of-bounds write vulnerability in read_dataset() in src/rawtovcd.c due to an unchecked variable index. Attackers can supply a crafted ngspice .raw file that, when converted with rawtovcd, writes file-controlled heap pointers at chosen signed offsets, corrupting heap memory.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.