# CVE-2023-24285: Simon Tatham Portable Puzzle Collection buffer overflow in game loading

Source: https://junglewise.ai/threats/cve-2023-24285-simon-tatham-portable-puzzle-collection-buffer-overflow-in-game  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2023-24285 · Severity: low · CVSS 2.9 · Published 2026-09-14

Portable Puzzle Collection is a suite of puzzle games. A buffer overflow vulnerability can be triggered by loading a malformed game description or save file, potentially allowing an attacker to execute arbitrary code if a user can be tricked into opening a crafted file.

Technologies: [Simon Tatham Portable Puzzle Collection](https://junglewise.ai/threats/technologies/portable-puzzle-collection). Vendors: [Simon Tatham](https://junglewise.ai/threats/vendors/simon-tatham).

## Quick answers

**Is CVE-2023-24285 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-24285 being exploited in the wild.

**How severe is CVE-2023-24285?** Low severity, with a CVSS score of 2.9, published 14 September 2026.

**Which products and versions are affected?** Simon Tatham Portable Puzzle Collection before 20230116.5782e29.

**Is there a fix for CVE-2023-24285?** A patch was published on 2023-01-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-24285 attacked?** It is attacked with local access.

**Am I affected by CVE-2023-24285?** Check whether you run Simon Tatham Portable Puzzle Collection at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a buffer overflow triggered by unusually long moves or malformed game descriptions/save files during parsing. The root cause involves inadequate bounds checking when processing game state data. The attack requires social engineering (tricking a user into opening a malicious save file or game description), as the application does not automatically handle these file types. An attacker can achieve memory corruption and potentially arbitrary code execution. The vulnerability was fixed upstream by version 20230122.806ae71 and patched in Debian versions 20230122.806ae71-1 and 20191231.79a5378-3+deb11u1.

## Affected products

- Simon Tatham Portable Puzzle Collection before 20230116.5782e29

## Timeline

- 2023-01-15: disclosed
- 2023-01-22: patched

## References

- [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1028986](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1028986)
- [https://git.tartarus.org/?p=simon/puzzles.git;a=commit;h=1aded127eb3fb7194a1752d96bfba95a5b7fa4dc](https://git.tartarus.org/?p=simon/puzzles.git;a=commit;h=1aded127eb3fb7194a1752d96bfba95a5b7fa4dc)

## Related threats

- [Simon Tatham's Portable Puzzle Collection buffer overflow in record parsing](https://junglewise.ai/threats/cve-2023-24291-simon-tatham-s-portable-puzzle-collection-buffer-overflow-in)
- [Simon Tatham Portable Puzzle Collection buffer overflow in save state handling](https://junglewise.ai/threats/cve-2023-24288-simon-tatham-portable-puzzle-collection-buffer-overflow-in-save)
- [Simon Tatham's Portable Puzzle Collection buffer overflow in game loading](https://junglewise.ai/threats/cve-2023-24287-simon-tatham-s-portable-puzzle-collection-buffer-overflow-in-game)
- [Simon Tatham's Portable Puzzle Collection buffer overflow](https://junglewise.ai/threats/cve-2023-24283-simon-tatham-s-portable-puzzle-collection-buffer-overflow)