CVE-2023-35995

What it actually does

Improper array index validation in fstReaderIterBlocks2 tdelta handling allows out-of-bounds memory access when processing a crafted .fst file with signal_lens set to 1, resulting in arbitrary code execution.

Why it matters to the business

An attacker can achieve full control of a user's workstation by tricking them into opening a malicious waveform file, leading to potential data theft, malware deployment, or lateral movement with no patch currently published for the affected GTKWave versions.

How an attack unfolds

An attacker crafts a malicious .fst file that triggers the tdelta indexing flaw when signal_lens equals 1. The victim opens the file in GTKWave, causing the application to execute attacker-controlled code. Public exploit code is available, though no named threat actors or ransomware campaigns have been observed using it.

How to fix it

Upgrade to the latest GTKWave release once a fix is published. Until then, avoid opening untrusted .fst files and consider sandboxing or disabling the application on high-risk systems. Monitor the project repository for patch releases addressing the fstReaderIterBlocks2 tdelta functionality.

How to confirm the fix worked

Confirm exposure by checking the GTKWave version string; test with known-bad .fst samples in an isolated environment to observe crashes or unexpected behavior. After any future update, re-verify by attempting to load the same crafted files without triggering code execution.

Typical attack path

1. Attacker creates a specially crafted .fst file exploiting the tdelta array indexing issue
2. Attacker delivers the file via email, download link, or shared storage
3. Victim opens the file in the vulnerable GTKWave application
4. The flaw triggers out-of-bounds access leading to arbitrary code execution
5. Attacker gains control of the process for further actions such as installing malware or exfiltrating data

How to detect it

Look in process creation logs, file-access telemetry, and application crash reports for GTKWave loading .fst files from unexpected locations. Correlate with subsequent suspicious child processes or network connections shortly after file open events.

What your security team should do

• Immediately restrict opening of .fst files from untrusted sources
• Monitor vendor announcements for an official patch and deploy as soon as available
• Add file-type restrictions or sandbox policies for waveform analysis tools
• Review EPSS and exploit availability trends periodically for changes in risk posture