{"id":"CVE-2026-128990","kind":"vulnerability","aliases":["CVE-2026-128990"],"related":[],"title":"xschem: crafted ngspice raw file corrupts heap memory during conversion","description":"xschem 2.9.9 through 3.4.7 contains a heap out-of-bounds write vulnerability in read_dataset() in src/rawtovcd.c due to an unchecked variable index. Attackers can supply a crafted ngspice .raw file that, when converted with rawtovcd, writes file-controlled heap pointers at chosen signed offsets, corrupting heap memory.","summary":"xschem's rawtovcd tool has an unchecked index in read_dataset() that lets a crafted ngspice .raw file write attacker-chosen pointers past a heap buffer. An attacker who gets a team to convert such a file can corrupt heap memory, which can lead to code execution.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eda","electronics-design","ngspice","package","xschem"],"not_affected_if":["no-rawtovcd-use","trusted-input-only"],"how_to_check":"- Check the installed xschem version, for example with `xschem --version`, and see whether it falls in 2.9.9 through 3.4.7.\n- Look for the rawtovcd tool in your install or build tree (src/rawtovcd.c).","fix":"- Move xschem past `3.4.7`, the last affected version in the sources; the fixed version is not stated in the sources.","status":"open","published_at":"2026-11-13T15:17:45+00:00","first_seen_at":"2026-11-13T15:46:20+00:00","triaged_at":"2026-11-13T15:48:15+00:00","updated_at":"2026-11-13T15:48:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:48:15Z","model":"claude-haiku-5-5","output":{"fix":"- Move xschem past `3.4.7`, the last affected version in the sources; the fixed version is not stated in the sources.","reach":"local","title":"xschem: crafted ngspice raw file corrupts heap memory during conversion","impact":"high","summary":"xschem's rawtovcd tool has an unchecked index in read_dataset() that lets a crafted ngspice .raw file write attacker-chosen pointers past a heap buffer. An attacker who gets a team to convert such a file can corrupt heap memory, which can lead to code execution.","audience":"developers","category":"package","nicknames":[],"who_cares":["xschem","eda","ngspice","electronics-design"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Heap memory corruption that may allow code execution on the converting machine","analyst_note":"Confirm the fixed version and whether the patch link on github.com covers this CVE, since the sources give no fixed version.","how_to_check":"- Check the installed xschem version, for example with `xschem --version`, and see whether it falls in 2.9.9 through 3.4.7.\n- Look for the rawtovcd tool in your install or build tree (src/rawtovcd.c).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-rawtovcd-use","trusted-input-only"],"who_is_affected":"Teams that run xschem 2.9.9 through 3.4.7 and convert ngspice .raw files with rawtovcd, especially on files from untrusted sources. Users who never run rawtovcd on outside files have much less exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":4633,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128990':13A,16A '-2026':12A,15A '2.9.9':73C '3.4.7':75C 'attack':44B,52B,96C 'attacker-chosen':43B 'bound':82C 'buffer':50B 'chosen':45B,116C 'code':70B 'contain':76C 'control':112C 'convers':10A 'convert':58B,106C 'corrupt':6A,63B,119C 'craft':2A,38B,100C 'cve':11A,14A 'dataset':34B,87C 'design':20B 'due':90C 'eda':17B 'electron':19B 'electronics-design':18B 'execut':71B 'file':5A,41B,61B,103C,111C 'file-control':110C 'get':54B 'heap':7A,49B,64B,78C,113C,120C 'index':31B,95C 'lead':68B 'let':36B 'memori':8A,65B,121C 'ngspice':3A,21B,39B,101C 'offset':118C 'out-of-bound':79C 'packag':22B 'past':47B 'pointer':46B,114C 'raw':4A,40B,102C 'rawtovcd':26B,108C 'read':33B,86C 'sign':117C 'src/rawtovcd.c':89C 'suppli':98C 'team':56B 'tool':27B 'uncheck':30B,93C 'variabl':94C 'vulner':84C 'write':42B,83C,109C 'xschem':1A,23B,24B,72C","nicknames":[],"mitigations":[],"who_affected":"Teams that run xschem 2.9.9 through 3.4.7 and convert ngspice .raw files with rawtovcd, especially on files from untrusted sources. Users who never run rawtovcd on outside files have much less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eda","electronicsdesign","high","ngspice","package","xschem"],"campaign_type":null,"search_a":"'-128990':13A,16A '-2026':12A,15A 'convers':10A 'corrupt':6A 'craft':2A 'cve':11A,14A 'file':5A 'heap':7A 'memori':8A 'ngspice':3A 'raw':4A 'xschem':1A","search_b":"'attack':44B,52B 'attacker-chosen':43B 'buffer':50B 'chosen':45B 'code':70B 'convert':58B 'corrupt':63B 'craft':38B 'dataset':34B 'design':20B 'eda':17B 'electron':19B 'electronics-design':18B 'execut':71B 'file':41B,61B 'get':54B 'heap':49B,64B 'index':31B 'lead':68B 'let':36B 'memori':65B 'ngspice':21B,39B 'packag':22B 'past':47B 'pointer':46B 'raw':40B 'rawtovcd':26B 'read':33B 'team':56B 'tool':27B 'uncheck':30B 'write':42B 'xschem':23B,24B","search_c":"'2.9.9':73C '3.4.7':75C 'attack':96C 'bound':82C 'chosen':116C 'contain':76C 'control':112C 'convert':106C 'corrupt':119C 'craft':100C 'dataset':87C 'due':90C 'file':103C,111C 'file-control':110C 'heap':78C,113C,120C 'index':95C 'memori':121C 'ngspice':101C 'offset':118C 'out-of-bound':79C 'pointer':114C 'raw':102C 'rawtovcd':108C 'read':86C 'sign':117C 'src/rawtovcd.c':89C 'suppli':98C 'uncheck':93C 'variabl':94C 'vulner':84C 'write':83C,109C 'xschem':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128990","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128990","severity":null,"published_at":"2026-11-13T15:17:45+00:00","modified_at":"2026-11-13T15:17:45+00:00","first_seen_at":"2026-11-13T15:46:20+00:00","fetched_at":"2026-11-13T15:46:20+00:00","note":null}],"documents":[{"id":147261,"url":"https://github.com/StefanSchippers/xschem/commit/e29af39c6133c36bdaf66603fd663231e75517f1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":147262,"url":"https://www.vulncheck.com/advisories/xschem-2.9.9-through-3.4.7-heap-out-of-bounds-write-via-rawtovcd-read-dataset","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}