CVE-2023-35057

What it actually does

Integer overflow during LXT2 lxt2_rd_trace value elements allocation allows an attacker-supplied .lxt2 file to cause out-of-bounds memory operations and corruption.

Why it matters to the business

Successful exploitation can result in arbitrary code execution on a user's workstation when a malicious waveform file is opened, potentially leading to data theft, system compromise, or ransomware deployment; the affected component is present in document-merge-service deployments that rely on the vulnerable GTKWave code.

How an attack unfolds

An attacker crafts a specially malformed .lxt2 file that triggers the integer overflow on allocation. The victim is tricked into opening the file with the affected application (for example via document-merge-service workflows that invoke GTKWave). The overflow corrupts memory structures, allowing the attacker to gain control of execution flow and execute arbitrary code.

How to fix it

Upgrade adfinis/document-merge-service to commit a1edd39d33d1bdf75c31ea01c317547be90ca074 or later; rebuild and redeploy any containers or packages that embed the vulnerable GTKWave 3.3.115 code; verify the updated binary no longer contains the vulnerable allocation path.

How to confirm the fix worked

Confirm the running binary or library reports the fixed commit hash; attempt to open a known-good .lxt2 file and a test case that previously triggered the overflow; review build logs to ensure the patched source was used.

Typical attack path

1. Attacker generates malicious .lxt2 file exploiting the allocation integer overflow
2. Attacker delivers the file to the victim through email, download link, or shared storage
3. Victim opens the file using the vulnerable GTKWave component within document-merge-service
4. Integer overflow occurs during lxt2_rd_trace processing, leading to memory corruption
5. Attacker payload gains code execution on the victim's system

How to detect it

Review file-access and process-creation logs for unexpected GTKWave or document-merge-service invocations involving .lxt2 files from untrusted sources; look for subsequent anomalous memory or crash artifacts in system logs.

What your security team should do

• Immediately update all instances of document-merge-service to the fixed commit a1edd39d33d1bdf75c31ea01c317547be90ca074
• Block or sandbox opening of untrusted .lxt2 files until patches are applied
• Add the fixed commit to dependency scanning and SBOM policies
• Monitor for any post-patch crash reports or memory sanitizer alerts related to LXT2 parsing