CVE-2023-35994

What it actually does

Improper array index validation in fstReaderIterBlocks2 tdelta initialization allows out-of-bounds access when parsing a crafted .fst file, resulting in arbitrary code execution.

Why it matters to the business

Successful exploitation grants an attacker full control of the affected workstation after a user opens a malicious waveform file, enabling data theft, ransomware deployment, or lateral movement with high operational disruption.

How an attack unfolds

An attacker crafts a .fst file that triggers the tdelta initialization flaw in GTKWave 3.3.115. The victim is tricked into opening the file, causing the buffer overflow and execution of attacker-supplied code. Public exploit code is available and the vulnerability has existed for over two years.

How to fix it

Upgrade GTKWave to a version that resolves the fstReaderIterBlocks2 tdelta vulnerabilities. Until a fixed release is available, restrict opening of untrusted .fst files and run the application under least-privilege sandboxing.

How to confirm the fix worked

Confirm the installed GTKWave version is newer than 3.3.115 and test that the application no longer crashes or executes unexpected code when loading known-malicious .fst samples.

Typical attack path

1. Craft a malicious .fst file exploiting tdelta array index validation
2. Deliver the file via email, download link, or shared storage
3. Victim opens the file in GTKWave
4. Trigger buffer overflow during tdelta initialization
5. Execute arbitrary code on the victim system

How to detect it

Review file-access logs and process-creation events for GTKWave opening .fst files from unexpected sources; look for subsequent crashes, anomalous child processes, or memory-corruption indicators shortly after file open.

What your security team should do

• Immediately block untrusted .fst files at email gateways and file-sharing services
• Inventory all GTKWave installations and prioritize patching
• Enforce application allow-listing or sandbox execution for waveform viewers
• Monitor for new fixed releases from the GTKWave project