CVE-2023-32650

What it actually does

Integer overflow during FST_BL_GEOM maxhandle parsing in 32-bit GTKWave builds causes memory corruption when a crafted .fst file is opened.

Why it matters to the business

Successful exploitation can lead to arbitrary code execution or application crashes on analyst or developer workstations that process waveform files, potentially exposing sensitive design data or enabling lateral movement.

How an attack unfolds

An attacker creates a malicious .fst file that triggers an integer overflow in the maxhandle handler. The victim opens the file with a 32-bit GTKWave binary, causing memory corruption that can be leveraged for code execution. Public exploit code is available and the issue has been known for over two years.

How to fix it

Upgrade GTKWave to a version that resolves the integer overflow. Compile as 64-bit where possible. Until a fix is released, avoid opening untrusted .fst files and consider alternative waveform viewers.

How to confirm the fix worked

Confirm GTKWave version and build architecture; attempt to open known-malicious test .fst files in an isolated environment and monitor for crashes or unexpected memory behavior.

Typical attack path

1. Craft .fst file containing oversized maxhandle value
2. Deliver file via email, download, or shared storage
3. Victim opens file in vulnerable 32-bit GTKWave instance
4. Overflow occurs during FST_BL_GEOM parsing
5. Memory corruption leads to code execution or crash

How to detect it

Review file-access logs and process execution records for GTKWave opening .fst files from unusual locations; correlate with subsequent crashes, unexpected child processes, or memory-related error logs.

What your security team should do

• Block or sandbox opening of .fst files from untrusted sources
• Migrate to 64-bit GTKWave builds immediately
• Monitor upstream for official patched release and deploy promptly
• Educate users handling waveform files about the risk of malicious attachments