CVE-2023-35992

What it actually does

Integer overflow in fstReaderIterBlocks2 vesc allocation when processing FST files in 32-bit GTKWave builds allows out-of-bounds memory writes, resulting in memory corruption.

Why it matters to the business

Opening a malicious waveform file can let an attacker take full control of the application and potentially the system, risking data theft, tampering, or disruption for engineering and verification teams that rely on the tool.

How an attack unfolds

An attacker crafts a specially malformed .fst file that triggers an integer overflow during block iteration and allocation. The victim opens the file with GTKWave (32-bit binary), causing the overflow to corrupt memory structures and allowing arbitrary code execution in the context of the application.

How to fix it

Upgrade GTKWave to a version that resolves the integer overflow in fstReaderIterBlocks2. If an update is unavailable, avoid opening untrusted .fst files and consider running the tool under a sandbox or with reduced privileges. Disable or remove 32-bit builds where possible.

How to confirm the fix worked

Confirm the installed GTKWave version is newer than 3.3.115 and test that specially crafted .fst files no longer trigger allocation overflows or crashes. Review build configuration to ensure 64-bit compilation where supported.

Typical attack path

1. Attacker generates a malicious .fst file exploiting the vesc allocation integer overflow
2. Attacker delivers the file via email, download link, or shared storage
3. Victim opens the file using GTKWave compiled as 32-bit
4. Overflow occurs during fstReaderIterBlocks2 processing, corrupting memory
5. Attacker gains arbitrary code execution within the GTKWave process

How to detect it

Review file-access logs and process creation events for GTKWave opening .fst files from unexpected locations. Look for sudden crashes or memory corruption indicators in application logs shortly after file opens. Check for post-exploitation artifacts such as unexpected child processes or network connections originating from the GTKWave binary.

What your security team should do

• Immediately restrict opening of .fst files from untrusted sources
• Upgrade GTKWave to the latest patched release as soon as it becomes available
• Add file-type restrictions or sandboxing policies for waveform viewers in engineering environments
• Monitor for new fixed versions and update build pipelines accordingly