CVE-2023-36747

What it actually does

Heap-based buffer overflow in fstReaderIterBlocks2 fstWritex len handling causes memory corruption when beg_time does not align with the time table start.

Why it matters to the business

Attackers can gain full control of affected systems used for waveform analysis, risking data theft, system disruption, and supply chain issues in hardware and EDA environments where the tool sees broad use.

How an attack unfolds

An attacker creates a malicious .fst file that triggers the len mishandling in fstWritex during block iteration; the victim opens the file in the vulnerable application, leading to memory corruption that can be leveraged for arbitrary code execution. Public exploits are available.

How to fix it

Upgrade to a patched version of GTKWave once released; in the interim, avoid opening .fst files from untrusted sources and consider sandboxing or alternative tools.

How to confirm the fix worked

Verify the installed GTKWave version against vendor releases; test by attempting to open a known benign .fst file and confirm no crashes or unexpected memory behavior occur.

Typical attack path

1. Craft a malicious .fst file exploiting len handling in fstWritex
2. Distribute the file via email, download, or shared storage
3. Victim opens the file in the vulnerable GTKWave application
4. Trigger buffer overflow and memory corruption
5. Achieve code execution or crash

How to detect it

Review file access logs for unexpected .fst files opened by the application; inspect system logs and crash reports for memory corruption indicators around the time of file access; correlate with process execution of gtkwave.

What your security team should do

• Block opening of .fst files from external sources until a fix is applied
• Monitor for new GTKWave releases and deploy updates promptly
• Educate users on risks of untrusted waveform files
• Scan systems for presence of GTKWave and assess exposure