CVE-2023-35997

What it actually does

Improper array index validation in fstReaderIterBlocks2 tdelta handling allows out-of-bounds memory access when processing .fst files where signal_lens is 2 or greater, resulting in arbitrary code execution.

Why it matters to the business

Users opening malicious waveform files risk complete system compromise, enabling attackers to run arbitrary code, steal data, or install persistent malware on engineering workstations.

How an attack unfolds

An attacker crafts a malicious .fst file that triggers the tdelta indexing flaw when signal_lens >= 2; the victim opens the file in GTKWave, causing the vulnerable code path to execute attacker-controlled data and achieve code execution.

How to fix it

Upgrade GTKWave to a version containing fixes for the tdelta indexing vulnerabilities; avoid opening untrusted .fst files until patched; consider sandboxing or disabling the application if no update is available.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115; test with known-good .fst files containing signal_lens values of 2 or greater; monitor for crashes or unexpected behavior on crafted inputs.

Typical attack path

1. Attacker creates specially crafted .fst file exploiting tdelta array indexing
2. Malicious file is delivered via email, download, or shared storage
3. Victim opens the file in GTKWave 3.3.115 or earlier
4. Vulnerable fstReaderIterBlocks2 function performs invalid array access
5. Attacker payload executes with user privileges

How to detect it

Review file access logs and process execution records for GTKWave opening .fst files from unusual locations; inspect system logs for segmentation faults or abnormal memory access patterns around the time of file opens.

• gtkwave.*\.fst
• fstReaderIterBlocks2

What your security team should do

• Immediately restrict opening of .fst files from untrusted sources
• Deploy application allow-listing or sandboxing for GTKWave
• Monitor for new upstream releases and apply fixes promptly given public exploit availability
• Educate users on risks of opening waveform files from external parties