CVE-2023-35964

What it actually does

The vulnerability allows arbitrary OS command execution through crafted input processed during decompression in the vcd2lxt utility.

Why it matters to the business

An attacker can achieve full system compromise on affected developer or engineering workstations if a malicious waveform file is opened, leading to data theft, persistence, or lateral movement; the issue has been public for over 1000 days with public exploits available, increasing long-term risk in environments using legacy waveform tools.

How an attack unfolds

An attacker creates a specially crafted wave file that abuses the decompression logic in vcd2lxt; the victim opens the file with the utility, triggering command injection and allowing the attacker to execute arbitrary commands on the local system.

How to fix it

Replace or isolate the vcd2lxt utility, avoid opening untrusted waveform files with GTKWave tools, and monitor vendor releases for patched versions of the affected package.

How to confirm the fix worked

Confirm the installed gtkwave package version and test that vcd2lxt rejects or safely handles known-malicious test files; review process execution logs for unexpected command invocations during file handling.

Typical attack path

1. Craft malicious wave file exploiting decompression command injection
2. Deliver file via email, download link, or shared storage
3. Victim opens file using vcd2lxt utility
4. Decompression routine executes attacker-controlled commands
5. Attacker gains code execution and establishes foothold

How to detect it

Review process creation logs and command-line audit trails for invocations of vcd2lxt that reference unusual file paths or arguments; correlate with file downloads or email attachments shortly before execution.

• vcd2lxt
• command injection via decompression
• crafted .vcd or .lxt files

What your security team should do

• Immediately restrict use of vcd2lxt to trusted files only
• Add file-type sandboxing or containerization for waveform analysis workflows
• Hunt for historical executions of vcd2lxt on developer endpoints
• Track upstream GTKWave releases for security updates