CVE-2023-35128

What it actually does

Integer overflow in fstReaderIterBlocks2 time_table tsec_nitems processing allows a crafted .fst file to corrupt memory during parsing.

Why it matters to the business

Users who open malicious waveform files risk full system compromise, enabling data theft, ransomware deployment, or persistent attacker access with no available patches listed.

How an attack unfolds

An attacker creates a malicious .fst file that triggers the integer overflow, then delivers it to a victim who opens it with GTKWave; the resulting memory corruption can be leveraged for arbitrary code execution.

How to fix it

No fixed versions are published; replace or isolate the affected GTKWave installation and prohibit opening untrusted .fst files.

How to confirm the fix worked

Confirm GTKWave version is not 3.3.115 or earlier; test file handling behavior with known-good versus crafted .fst samples in a sandbox.

Typical attack path

1. Craft .fst file containing oversized tsec_nitems values
2. Deliver the file via email, download, or shared storage
3. Victim opens the file in GTKWave
4. Integer overflow occurs during block iteration leading to memory corruption and potential code execution

How to detect it

Review system logs and process behavior for GTKWave crashes or anomalous memory allocations immediately after .fst file access; inspect recent file-open events for suspicious .fst sources.

What your security team should do

• Immediately restrict or disable GTKWave usage on untrusted files
• Block .fst file extensions at email and web gateways
• Monitor for new upstream releases and apply fixes when published
• Educate users about risks of opening waveform files from unknown sources