CVE-2023-24285 Overview
CVE-2023-24285 is a buffer overflow vulnerability [CWE-120] in Simon Tatham's Portable Puzzle Collection before version 20230116.5782e29. The flaw is triggered when an unusually long move is executed within an affected puzzle. An attacker with local access can supply crafted input that overruns a fixed-size buffer, producing a crash of the running puzzle process. The issue was addressed upstream in commit 1aded127eb3fb7194a1752d96bfba95a5b7fa4dc and tracked in Debian as bug #1028986.
Critical Impact
Successful exploitation causes a local availability impact (application crash) in the affected puzzle binary. Confidentiality and integrity are not affected.
Affected Products
- Simon Tatham's Portable Puzzle Collection versions before 20230116.5782e29
- Downstream Debian packages tracked under bug #1028986
- Third-party builds and repackaged distributions incorporating the pre-patch source
Discovery Timeline
- 2026-09-14 - CVE-2023-24285 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2023-24285
Vulnerability Analysis
The vulnerability is a classic buffer overflow [CWE-120] in the move-handling logic of the Portable Puzzle Collection. Puzzle games in this collection accept move descriptions as strings that are parsed and applied to game state. When the move string exceeds the length assumed by the parser, data is written past the bounds of the destination buffer.
The advisory identifies the trigger as an "unusually long move" executed against a puzzle. Because the collection runs as a local user-mode application without elevated privileges, exploitation is limited to the user's own session. The realistic outcome is a process crash rather than arbitrary code execution.
Exploitation requires local delivery of the malicious input, typically through a saved game file, a copied move sequence, or a scripted interaction with the puzzle binary. No authentication is required beyond the ability to launch the puzzle.
Root Cause
The root cause is missing or insufficient bounds checking on move-string input before it is copied into a fixed-size buffer. The upstream fix in commit 1aded127eb3fb7194a1752d96bfba95a5b7fa4dc corrects the length handling so that oversized move descriptions no longer overflow the destination buffer.
Attack Vector
An attacker with local access to the puzzle binary supplies a crafted move sequence, for example through a saved-state file loaded by the puzzle. The oversized move is passed to the parser, which writes beyond the buffer boundary and destabilizes the process. Attack complexity is high because the attacker must construct an input that reaches the vulnerable code path, and the impact is limited to availability of the puzzle process itself.
See the Tartarus Git Commit 1aded12 for the upstream patch and the Debian Bug Report #1028986 for downstream tracking.
Detection Methods for CVE-2023-24285
Indicators of Compromise
- Unexpected crashes or abnormal termination of Portable Puzzle Collection binaries during move processing.
- Saved-game or state files containing move strings that are substantially longer than legitimate gameplay would produce.
- Core dumps or crash reports referencing move-parsing routines in an unpatched puzzles build.
Detection Strategies
- Inventory installed puzzle packages and compare versions against 20230116.5782e29 or later.
- Monitor package managers for outdated puzzles or equivalent distribution packages on managed endpoints.
- Review any user-provided saved-game files for anomalous string lengths in move fields prior to loading.
Monitoring Recommendations
- Enable operating system crash reporting to capture segmentation faults from puzzle binaries.
- Track process termination telemetry for puzzle executables to identify repeated crash patterns.
- Alert on the introduction of unusually large puzzle save files on shared or multi-user systems.
How to Mitigate CVE-2023-24285
Immediate Actions Required
- Upgrade the Portable Puzzle Collection to version 20230116.5782e29 or later, which includes commit 1aded127eb3fb7194a1752d96bfba95a5b7fa4dc.
- Apply distribution updates that incorporate the upstream fix, including Debian packages tracked under bug #1028986.
- Avoid opening saved-game files received from untrusted sources on unpatched systems.
Patch Information
The upstream fix is available in the Portable Puzzle Collection Git repository as commit 1aded127eb3fb7194a1752d96bfba95a5b7fa4dc. Downstream distributions such as Debian have tracked and packaged the fix under Debian Bug Report #1028986. Users should install the vendor-provided package update for their platform.
Workarounds
- Restrict use of the puzzle binaries to trusted local input and avoid loading untrusted saved-game files.
- Remove or disable the affected puzzle packages on multi-user systems until patched builds are deployed.
- Run affected applications under a standard user account with no elevated privileges to limit the blast radius of any crash.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
