CVE-2023-35702

What it actually does

Stack-based buffer overflow in fstReaderVarint32 allows arbitrary code execution when parsing a malicious LEB128 varint value from a crafted .fst file.

Why it matters to the business

Compromise of engineering workstations or servers that open waveform files can lead to full system takeover, loss of proprietary design data, and disruption of hardware verification workflows; urgency is moderate given low EPSS and lack of known in-the-wild exploitation.

How an attack unfolds

An attacker crafts a .fst file containing an oversized LEB128 varint that overflows the stack buffer inside fstReaderVarint32. The victim opens the file with GTKWave, the overflow occurs during parsing, and attacker-controlled data on the stack is executed, achieving arbitrary code execution.

How to fix it

Update GTKWave to a version that contains a corrected fstReaderVarint32 implementation; if no patched release is yet available, avoid opening .fst files from untrusted sources and run the application under a restricted user account or sandbox.

How to confirm the fix worked

Confirm GTKWave binary no longer contains the vulnerable fstReaderVarint32 path by inspecting the updated source or running a fuzzer against the LEB128 parser; test that previously crashing .fst samples are rejected cleanly without memory corruption.

Typical attack path

1. Create malicious .fst file with oversized LEB128 varint targeting fstReaderVarint32
2. Deliver file via email, download link, or shared storage
3. Victim opens file in GTKWave 3.3.115 or earlier
4. Overflow triggers and attacker payload executes on the stack
5. Establish persistence or exfiltrate data from the compromised host

How to detect it

Search endpoint logs and EDR telemetry for GTKWave processes that terminate abnormally after opening .fst files or that spawn unexpected child processes; review file-download and email-attachment logs for .fst files received from external sources around the time of any suspicious activity.

• gtkwave.exe
• gtkwave
• .fst

What your security team should do

• Block untrusted .fst files at email gateways and file-sharing services until a fixed GTKWave build is deployed
• Inventory all systems with GTKWave installed and prioritize patching of developer and lab machines
• Add .fst file type to application allow-listing policies where feasible
• Monitor for GTKWave process crashes or unexpected child process creation after .fst handling