CVE-2023-36746

What it actually does

Heap-based buffer overflow in fstReaderIterBlocks2 fstWritex len handling during time table parsing of .fst files, resulting in memory corruption.

Why it matters to the business

Attackers can achieve code execution on analyst workstations by tricking users into opening malicious waveform files, risking data exfiltration or further network compromise in environments that rely on GTKWave for signal analysis.

How an attack unfolds

An attacker creates a crafted .fst file that supplies an oversized or malformed len value to fstWritex while the time table is parsed; when a victim opens the file in GTKWave the overflow corrupts heap memory and allows arbitrary code execution.

How to fix it

Upgrade GTKWave to the latest release that corrects the fstWritex len handling; until then restrict opening of .fst files from untrusted sources and run the application under sandboxing or least-privilege accounts.

How to confirm the fix worked

Confirm the installed GTKWave version is newer than 3.3.115, test that a known-good .fst file still loads correctly, and attempt to open a synthetically malformed test file to verify the overflow no longer occurs.

Typical attack path

1. Craft malicious .fst file with malformed time-table len field
2. Deliver file via email, download, or shared storage
3. Victim opens file with GTKWave
4. Buffer overflow triggers memory corruption and payload execution

How to detect it

Review system and application logs for GTKWave crashes or segfaults immediately after .fst file access; inspect recent file-open events for .fst files originating outside expected project directories.

What your security team should do

• Block untrusted .fst files at mail and web gateways
• Update GTKWave across all analyst systems
• Add file-type sandboxing for waveform viewers
• Monitor for GTKWave crashes or unusual memory allocations