Description

An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers to cause a Denial of Service (DoS) via creating an excessive amount of save states.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.9",
  "pubDate": "2026-09-14T05:16:56.560Z",
  "pubdate": "2026-09-14T05:16:56.560Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists within the Portable Puzzle Collection, specifically affecting versions prior to 20230116.5782e29.\nThe issue stems from insufficient resource management during the save state creation process, allowing an attacker to exhaust system resources.\nBy programmatically generating an excessive quantity of save state files, an attacker can induce resource starvation, leading to application instability or total failure.\nThis vulnerability poses a risk to system availability, as the targeted application may become unresponsive or crash due to disk space exhaustion or overhead associated with managing a massive number of files.\nThe attack does not require advanced privileges or authentication, provided the attacker has the ability to interact with the save state functionality of the software.\nThe impact is primarily localized to the availability of the Portable Puzzle Collection, but sustained exploitation could potentially affect underlying filesystem performance depending on the target environment.",
  "technicalDetails": "The root cause of this vulnerability is a lack of rate limiting or upper bounds on the number of save states an instance of Portable Puzzle Collection can generate.\nThe application architecture fails to implement a verification mechanism that limits cumulative save state volume per user session or globally per application instance.\nWhen an attacker triggers the save state routine repeatedly in rapid succession, the application continuously creates new file handles and writes data to the disk without pruning older entries or checking for environmental limitations.\nThe attack flow involves the automated invocation of the save state command, which is typically exposed through the application interface or internal state management functions. By automating this process, an attacker can quickly saturate the target directory with thousands of redundant files.\nAs the directory containing the save states grows, the filesystem metadata overhead increases, and the application's internal indexing or management routines consume increasing amounts of CPU and memory.\nThe exhaustion of available disk space or the hitting of filesystem-level inode limits represents the terminal state of the exploit, resulting in the application's inability to write further data, leading to a crash or a complete hang.\nThis vulnerability is classified as an Unauthenticated Denial of Service, as no specific privileges are required to exercise the save state functionality in default configurations. The exposure is limited to environments where the application or the user executing the application has write permissions to the storage location designated for save states.\nPost-exploitation, the system remains in a degraded or unusable state until administrative intervention occurs to purge the excessive save state files. The vulnerability demonstrates a failure in secure input and resource management policies where user-invokable state persistence operations are not appropriately governed by quotas or administrative limits."
}