CVE-2023-35996

What it actually does

Improper array index validation in fstReaderIterBlocks2 tdelta handling when signal_lens is 0 allows out-of-bounds memory access from a crafted .fst file, resulting in arbitrary code execution.

Why it matters to the business

Users who open malicious waveform files can have their systems fully compromised, enabling data theft, ransomware deployment, or persistent attacker access with high operational disruption risk.

How an attack unfolds

An attacker creates a malicious .fst file that triggers the tdelta indexing flaw when signal_lens equals zero. The file is delivered to a victim who opens it in GTKWave 3.3.115, causing the vulnerability to execute attacker-controlled code on the local system.

How to fix it

No fixed versions are currently published; immediately upgrade to the latest GTKWave release when available. In the interim, restrict opening of .fst files from untrusted sources and run the application under least-privilege or sandboxed conditions.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115, attempt to open known-good and crafted test .fst files in an isolated environment, and verify that no crash or unexpected memory access occurs.

Typical attack path

1. Craft .fst file exploiting tdelta array indexing flaw with signal_lens=0
2. Deliver malicious file via email, web download, or shared storage
3. Victim opens file in vulnerable GTKWave instance
4. Out-of-bounds access leads to arbitrary code execution

How to detect it

Review file-access logs and process creation events for GTKWave opening .fst files from unusual locations or with anomalous sizes; correlate with subsequent suspicious child processes or memory anomalies.

What your security team should do

• Block or sandbox opening of .fst files from external sources until a patch is applied
• Monitor vendor announcements for an official fixed release
• Educate users on risks of opening untrusted waveform files
• Deploy application allow-listing or containerization for GTKWave