CVE-2023-34087

What it actually does

Improper array index validation during EVCD variable-length parsing allows out-of-bounds memory access, enabling memory corruption that leads to arbitrary code execution when a crafted file is processed.

Why it matters to the business

Workstations running waveform analysis tools can be fully compromised, allowing attackers to steal design data, install persistent malware, or pivot into engineering networks if users open untrusted files.

How an attack unfolds

An attacker creates a malicious .evcd file that triggers the parsing flaw, then delivers it via email, shared storage, or download. When the victim opens the file in the vulnerable application, the corrupted index leads to code execution under the user's privileges.

How to fix it

Upgrade to a patched version of GTKWave as soon as one becomes available. Until then, avoid opening any .evcd files from untrusted sources and consider sandboxing or disabling the EVCD import feature if possible.

How to confirm the fix worked

Confirm the application version is newer than 3.3.115 and test that opening a known-good .evcd file succeeds without crashes or unexpected behavior. Monitor vendor release notes for the specific fix commit.

Typical attack path

1. Craft a specially malformed .evcd file that exploits the array index flaw
2. Deliver the file to the target user through email, file share, or web download
3. Trick the user into opening the file with the vulnerable application
4. Trigger parsing of the variable-length record, causing memory corruption and shellcode execution

How to detect it

Review file-access logs and process creation events around GTKWave execution for unexpected .evcd files originating outside normal design repositories. Look for crashes or abnormal memory behavior in the application shortly after file open.

What your security team should do

• Block or filter .evcd attachments in email gateways until patches are deployed
• Update application inventory to identify all instances of GTKWave and schedule upgrades
• Educate engineering teams on the risk of opening waveform files from external parties
• Implement application allow-listing or sandbox execution for analysis tools