The vulnerability is a stack buffer overflow in Simon Tatham’s Portable Puzzle Collection reported before the 20230116.5782e29 revision. A user can trigger the overflow by loading a maliciously crafted save file, which causes the program to crash. The result is a denial of service that disrupts the availability of the application but does not compromise data confidentiality.

All installations of the Portable Puzzle Collection that predate the 20230116.5782e29 revision are affected. The code base is platform‑independent, so users on any supported operating system who run an unpatched version are at risk if they open a malicious save file.

The CVSS score of 2.9 indicates low severity. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is unlikely in the wild. The likely attack vector involves an attacker supplying a crafted save file to a user embedding the file in a shared location, after which a local user loads the file. Because the flaw requires local file execution, widespread remote exploitation is improbable, but an unpatched system can suffer repeated crashes that degrade user experience.