xschem versions 2.9.9 through 3.4.7 contain a heap out-of-bounds write vulnerability in the read_dataset() function within src/rawtovcd.c. This flaw arises from an unchecked variable index, allowing attackers to craft malicious ngspice .raw files that cause heap memory corruption during conversion with rawtovcd.