CVE-2023-35969

What it actually does

Heap-based buffer overflow in fstReaderIterBlocks2 during chain_table parsing of FST_BL_VCDATA and FST_BL_VCDATA_DYN_ALIAS sections allows arbitrary code execution when processing a crafted .fst file.

Why it matters to the business

Successful exploitation grants attackers full control over the system running the vulnerable application, enabling data theft, malware deployment, or further network compromise; the issue affects waveform analysis workflows but remains low-prevalence given the specialized nature of the software.

How an attack unfolds

An attacker crafts a malicious .fst file containing oversized chain_table data in the FST_BL_VCDATA or FST_BL_VCDATA_DYN_ALIAS sections. The victim is tricked into opening the file with the vulnerable application, triggering the buffer overflow and resulting in arbitrary code execution. Public exploit code is available.

How to fix it

No fixed versions are listed in the available data; immediately avoid opening untrusted .fst files and monitor vendor releases for patches. Disable or sandbox the application where possible until an update is available.

How to confirm the fix worked

Confirm the application version against the latest available release; attempt to open a known-malicious test .fst file in an isolated environment and monitor for crashes or unexpected behavior; review source code or binary for the affected fstReaderIterBlocks2 function.

Typical attack path

1. Craft .fst file with malicious chain_table data targeting FST_BL_VCDATA or FST_BL_VCDATA_DYN_ALIAS sections
2. Deliver the file via email, download link, or shared storage
3. Victim opens the file in the vulnerable application
4. Parser processes the malformed chain_table and overflows the heap buffer
5. Attacker-supplied payload executes with the privileges of the application process

How to detect it

Review application crash logs and file-open events for .fst files; look for unexpected heap corruption indicators or child processes spawned from the viewer; correlate with email or download logs showing delivery of .fst attachments.

• .fst files containing FST_BL_VCDATA or FST_BL_VCDATA_DYN_ALIAS sections with abnormal chain_table sizes
• Application process crashes during .fst parsing
• Unexpected child process creation from gtkwave executable

What your security team should do

• Block or sandbox execution of the affected application until a patch is released
• Implement file-type restrictions and user training to prevent opening untrusted .fst files
• Monitor vendor announcements and apply updates as soon as fixed versions become available
• Add .fst file handling to endpoint detection rules and review logs for unexpected process crashes