# CVE-2023-24284: Portable Puzzle Collection buffer overflow in is_markable()

Source: https://junglewise.ai/threats/cve-2023-24284-portable-puzzle-collection-buffer-overflow-in-is-markable  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2023-24284 · Severity: low · CVSS 2.9 · Published 2026-09-14

Portable Puzzle Collection, a collection of puzzle games, contains a buffer overflow vulnerability in the is_markable() function. An attacker can craft a malformed game description or save file that, when loaded by a user, triggers a buffer overflow. This could potentially lead to code execution or application crash, though exploitation requires social engineering a user to load the malicious file.

## Quick answers

**Is CVE-2023-24284 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-24284 being exploited in the wild.

**How severe is CVE-2023-24284?** Low severity, with a CVSS score of 2.9, published 14 September 2026.

**Which products and versions are affected?** Portable Puzzle Collection before 20230116.5782e29.

**Is there a fix for CVE-2023-24284?** A patch was published on 2023-01-22: Fixed in upstream commit 5279fd24b2f4a51e and Debian version 20230122.806ae71-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-24284 attacked?** It is attacked with local access.

**Am I affected by CVE-2023-24284?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a buffer overflow in the is_markable() function triggered by malformed game descriptions or save files. The root cause involves insufficient bounds checking when processing game state data. An attacker-controlled game description or save file can cause the application to write beyond buffer boundaries, potentially achieving arbitrary code execution. The attack vector requires local interaction—a user must be tricked into opening a malicious file. The issue was fixed in upstream commit 5279fd24b2f4a51e760bfde873fe1d29547220a6 and patched in Debian version 20230122.806ae71-1.

## Affected products

- Portable Puzzle Collection before 20230116.5782e29

## Timeline

- 2023-01-15: disclosed: Reported to Debian as bug #1028986
- 2023-01-22: patched: Fixed in upstream commit 5279fd24b2f4a51e and Debian version 20230122.806ae71-1

## References

- [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1028986](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1028986)
- [https://git.tartarus.org/?p=simon/puzzles.git;a=commit;h=5279fd24b2f4a51e760bfde873fe1d29547220a6](https://git.tartarus.org/?p=simon/puzzles.git;a=commit;h=5279fd24b2f4a51e760bfde873fe1d29547220a6)