CVE-2023-35004

What it actually does

Integer overflow in VZT longest_len value allocation leads to undersized buffer and subsequent memory corruption, enabling arbitrary code execution upon opening a crafted file.

Why it matters to the business

Systems used for hardware simulation and signal analysis become susceptible to full compromise when users open malicious waveform files, increasing risk of data theft or persistent access in engineering environments.

How an attack unfolds

An attacker crafts a .vzt file that supplies an oversized longest_len value to trigger the integer overflow during allocation. The victim opens the file in GTKWave, causing memory corruption that a public exploit can turn into arbitrary code execution.

How to fix it

Upgrade GTKWave to a version containing the fix for the VZT allocation overflow. Until a patch is available, disable VZT support if possible or open files only inside a sandboxed or virtualized environment.

How to confirm the fix worked

Confirm GTKWave version exceeds the vulnerable release; attempt to parse known-malicious test files in an isolated environment and verify absence of crashes or unexpected memory behavior.

Typical attack path

1. Craft malicious .vzt file containing oversized longest_len value
2. Distribute file via email, download link, or shared storage
3. Victim opens file in vulnerable GTKWave instance
4. Integer overflow causes heap corruption and attacker code execution

How to detect it

Review system and application logs for GTKWave crashes or segmentation faults immediately after VZT file access; correlate with file creation or download events involving .vzt extensions.

What your security team should do

• Apply available GTKWave updates immediately across all analyst workstations
• Block or quarantine untrusted .vzt files at email and file-share gateways
• Restrict GTKWave execution to sandboxed or virtual desktop environments
• Add file-type and hash-based alerts for VZT files received from external sources