{"id":"CVE-2026-128991","kind":"vulnerability","aliases":["CVE-2026-128991"],"related":[],"title":"xschem: crafted schematic file causes out-of-bounds read and crash","description":"xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in read_xschem_file() in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a \"[\" record, causing xschem to read and dereference memory below the instance array and crash.","summary":"xschem is an electronic schematic editor, and versions 2.9.9 through 3.4.7 mishandle embedded-symbol records that lack a preceding instance in read_xschem_file(). A crafted schematic file that starts with a \"[\" record makes xschem read memory below the instance array, causing a crash.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eda","electronics","other","xschem"],"not_affected_if":["trusted-files-only","xschem-outside-version-range"],"how_to_check":"- Check the installed xschem version with `xschem --version`\n- Look for xschem in the sources you open or receive, and check whether it is one of the versions named above","fix":"- Move to a version newer than `3.4.7`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-11-13T15:17:45+00:00","first_seen_at":"2026-11-13T15:46:20+00:00","triaged_at":"2026-11-13T15:48:57+00:00","updated_at":"2026-11-13T15:48:57+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T15:48:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version newer than `3.4.7`; the exact fixed version is unknown from the sources","reach":"local","title":"xschem: crafted schematic file causes out-of-bounds read and crash","impact":"low","summary":"xschem is an electronic schematic editor, and versions 2.9.9 through 3.4.7 mishandle embedded-symbol records that lack a preceding instance in read_xschem_file(). A crafted schematic file that starts with a \"[\" record makes xschem read memory below the instance array, causing a crash.","audience":"developers","category":"other","nicknames":[],"who_cares":["xschem","eda","electronics"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Crafted file crashes xschem through an out-of-bounds memory read","analyst_note":"Confirm the exact fixed xschem version from the linked patch at github.com before publishing the fix field.","how_to_check":"- Check the installed xschem version with `xschem --version`\n- Look for xschem in the sources you open or receive, and check whether it is one of the versions named above","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["xschem-outside-version-range","trusted-files-only"],"who_is_affected":"Anyone who opens untrusted or third-party xschem schematic files in an affected version is exposed, since the flaw is triggered by the file contents. Teams that only edit their own schematics and never open outside files are at lower risk. unknown whether a patch version is named in the sources beyond the linked fix.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000745,"input_tokens":4619,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128991':15A,18A '-2026':14A,17A '2.9.9':31B,69C '3.4.7':33B,71C 'array':64B,116C 'attack':96C 'begin':102C 'bound':9A,77C 'caus':5A,65B,106C 'contain':72C 'craft':2A,49B,100C 'crash':12A,67B,118C 'cve':13A,16A 'derefer':111C 'eda':19B 'editor':28B 'electron':20B,26B 'embed':36B,89C 'embedded-symbol':35B,88C 'file':4A,47B,51B,83C 'instanc':43B,63B,95C,115C 'lack':40B,92C 'make':57B 'memori':60B,112C 'mishandl':34B,87C 'out-of-bound':6A,74C 'preced':42B,94C 'read':10A,45B,59B,78C,81C,109C 'record':38B,56B,91C,105C 'schemat':3A,27B,50B,101C 'src/save.c':85C 'start':53B 'suppli':98C 'symbol':37B,90C 'version':30B 'vulner':79C 'xschem':1A,22B,23B,46B,58B,68C,82C,107C","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens untrusted or third-party xschem schematic files in an affected version is exposed, since the flaw is triggered by the file contents. Teams that only edit their own schematics and never open outside files are at lower risk. unknown whether a patch version is named in the sources beyond the linked fix.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eda","electronics","medium","other","xschem"],"campaign_type":null,"search_a":"'-128991':15A,18A '-2026':14A,17A 'bound':9A 'caus':5A 'craft':2A 'crash':12A 'cve':13A,16A 'file':4A 'out-of-bound':6A 'read':10A 'schemat':3A 'xschem':1A","search_b":"'2.9.9':31B '3.4.7':33B 'array':64B 'caus':65B 'craft':49B 'crash':67B 'eda':19B 'editor':28B 'electron':20B,26B 'embed':36B 'embedded-symbol':35B 'file':47B,51B 'instanc':43B,63B 'lack':40B 'make':57B 'memori':60B 'mishandl':34B 'preced':42B 'read':45B,59B 'record':38B,56B 'schemat':27B,50B 'start':53B 'symbol':37B 'version':30B 'xschem':22B,23B,46B,58B","search_c":"'2.9.9':69C '3.4.7':71C 'array':116C 'attack':96C 'begin':102C 'bound':77C 'caus':106C 'contain':72C 'craft':100C 'crash':118C 'derefer':111C 'embed':89C 'embedded-symbol':88C 'file':83C 'instanc':95C,115C 'lack':92C 'memori':112C 'mishandl':87C 'out-of-bound':74C 'preced':94C 'read':78C,81C,109C 'record':91C,105C 'schemat':101C 'src/save.c':85C 'suppli':98C 'symbol':90C 'vulner':79C 'xschem':68C,82C,107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128991","severity":null,"published_at":"2026-11-13T15:17:45+00:00","modified_at":"2026-11-13T15:17:45+00:00","first_seen_at":"2026-11-13T15:46:20+00:00","fetched_at":"2026-11-13T15:46:20+00:00","note":null}],"documents":[{"id":147261,"url":"https://github.com/StefanSchippers/xschem/commit/e29af39c6133c36bdaf66603fd663231e75517f1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":147264,"url":"https://www.vulncheck.com/advisories/xschem-2.9.9-through-3.4.7-out-of-bounds-read-via-read-xschem-file-embedded-symbol-record","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}