Is CVE-2023-24288 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-24288 being exploited in the wild.

How severe is CVE-2023-24288?

Low severity, with a CVSS score of 2.9, published 14 September 2026.

Which products and versions are affected?

Simon Tatham Portable Puzzle Collection before 20230116.5782e29.

Is there a fix for CVE-2023-24288?

A patch was published on 2023-01-22: Fixed upstream in version 20230122.806ae71 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-24288 attacked?

It is attacked with local access.

Am I affected by CVE-2023-24288?

Check whether you run Simon Tatham Portable Puzzle Collection at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-24288: Simon Tatham Portable Puzzle Collection buffer overflow in save state handling

CVE-2023-24288 · Severity: low · CVSS 2.9 · Published 2026-09-14

Simon Tatham's Portable Puzzle Collection is a collection of classic puzzle games available across multiple platforms. A vulnerability in game file and save state parsing allows an attacker to trigger a buffer overflow or integer overflow by creating malformed save files or game descriptions, potentially causing the application to crash or execute arbitrary code. Users can be tricked into loading malicious save files through social engineering.

Technologies: Simon Tatham Portable Puzzle Collection. Vendors: Simon Tatham.

Quick answers

Is CVE-2023-24288 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-24288 being exploited in the wild.
How severe is CVE-2023-24288?: Low severity, with a CVSS score of 2.9, published 14 September 2026.
Which products and versions are affected?: Simon Tatham Portable Puzzle Collection before 20230116.5782e29.
Is there a fix for CVE-2023-24288?: A patch was published on 2023-01-22: Fixed upstream in version 20230122.806ae71 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-24288 attacked?: It is attacked with local access.
Am I affected by CVE-2023-24288?: Check whether you run Simon Tatham Portable Puzzle Collection at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability involves multiple integer overflow and buffer overflow issues in the game loading code of Portable Puzzle Collection. Malformed game descriptions or save files can trigger integer overflows that subsequently cause buffer overflows during parsing and loading. The attack vector requires user interaction—a user must be tricked into loading a specially crafted save file or game description. The Debian package does not register media type handlers for save files, limiting the attack surface. The vulnerability was fixed in upstream version 20230122.806ae71 and patched in Debian version 20230122.806ae71-1 (released 2023-01-24).

Affected products

Simon Tatham Portable Puzzle Collection before 20230116.5782e29

Timeline

2023-01-15: disclosed: Bug reported to Debian
2023-01-22: patched: Fixed upstream in version 20230122.806ae71
2026-09-14: advisory: CVE-2023-24288 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.