CVE-2023-24286: Puzzle Collection Buffer Overflow Flaw

CVE-2023-24286 Overview

CVE-2023-24286 is a buffer overflow vulnerability in Simon Tatham's Portable Puzzle Collection before version 20230116.5782e29. The flaw resides in the handling of the game description parameter, which fails to properly enforce boundary checks on user-supplied input. An attacker with local access can trigger the overflow by supplying a crafted game description, potentially causing the affected puzzle process to crash. The issue is classified under [CWE-120] Buffer Copy without Checking Size of Input. The vulnerability requires local access and high attack complexity, and it does not lead to code execution or data disclosure based on the published scoring.

Critical Impact
A local attacker supplying a malformed game description can trigger a buffer overflow that impacts availability of the affected puzzle process.

Affected Products

Simon Tatham's Portable Puzzle Collection versions prior to 20230116.5782e29
Distributions bundling the affected puzzle binaries
Downstream forks incorporating the vulnerable game description parser

Discovery Timeline

2026-09-14 - CVE-2023-24286 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-24286

Vulnerability Analysis

The vulnerability originates in the game description parser used by the Portable Puzzle Collection. The parser accepts a serialized game description string used to reconstruct puzzle state. Insufficient bounds checking on this input allows an oversized or malformed string to write past the intended buffer boundary. The result is memory corruption in the process address space of the puzzle binary. Exploitation requires local delivery of the crafted description and specific runtime conditions, which limits practical attack scenarios. The public impact is degraded availability of the affected process rather than confidentiality or integrity loss.

Root Cause

The root cause is a classic [CWE-120] Buffer Copy without Checking Size of Input. The affected code path copies attacker-controlled bytes from the game description into a fixed-size buffer without validating the input length. When the input exceeds the destination buffer, adjacent memory is overwritten, producing undefined behavior in the puzzle process.

Attack Vector

The attack vector is local. An attacker must convince a user to load a malicious game description file or paste a crafted description string into the puzzle application. No authentication or user interaction beyond loading the crafted input is required by the parser itself. The upstream fix is available in commit a539f38efd0d821c8325846fc879a3e46d6412bf published to the project's Tartarus Git repository.

No verified public exploit code is available for this issue. Refer to the upstream commit for the specific parser changes that enforce input length validation.

Detection Methods for CVE-2023-24286

Indicators of Compromise

Unexpected crashes or segmentation faults in Portable Puzzle Collection binaries when loading saved games or descriptions
Puzzle files or clipboard payloads containing abnormally long game description strings
Core dumps from puzzle processes originating from parsing routines

Detection Strategies

Monitor process termination events for puzzle binaries with abnormal exit codes on user endpoints
Inspect saved puzzle files delivered via email, download, or removable media for oversized description fields
Compare installed puzzle binary hashes against the fixed upstream build 20230116.5782e29 or later

Monitoring Recommendations

Enable operating system crash reporting to capture stack traces from the puzzle process
Log file access to puzzle save directories and correlate with subsequent process crashes
Alert on installation of vulnerable puzzle binaries from unofficial repositories or archives

How to Mitigate CVE-2023-24286

Immediate Actions Required

Upgrade Portable Puzzle Collection to a build that includes commit a539f38efd0d821c8325846fc879a3e46d6412bf or later
Remove untrusted puzzle save files and game descriptions received from external sources
Rebuild any downstream packages that vendor the affected puzzle source

Patch Information

The upstream fix is committed to the project repository as a539f38efd0d821c8325846fc879a3e46d6412bf. Users should install builds dated 20230116 or later that incorporate this commit. Package maintainers on Linux distributions should synchronize with the upstream release. Full patch details are available in the Tartarus Git commit.

Workarounds

Avoid loading puzzle game descriptions from untrusted sources until the patched build is deployed
Run puzzle binaries under a restricted user account to limit the impact of a process crash
Restrict write access to puzzle save directories to reduce the attack surface for local exploitation

bash

# Verify the installed puzzle binary version and rebuild from patched source
git clone https://git.tartarus.org/simon/puzzles.git
cd puzzles
git checkout a539f38efd0d821c8325846fc879a3e46d6412bf
cmake . && make