CVE-2023-36861

What it actually does

Out-of-bounds write in VZT LZMA_read_varint parsing allows arbitrary code execution when a crafted file is processed.

Why it matters to the business

Attackers could gain full control of user workstations used for hardware design or signal analysis, risking theft of proprietary designs or further network compromise.

How an attack unfolds

An attacker creates a malicious .vzt file that triggers the out-of-bounds write during LZMA varint decoding; the victim opens the file in GTKWave, causing the vulnerable code path to execute attacker-controlled instructions.

How to fix it

Upgrade GTKWave to the latest available release that resolves the VZT parsing issue; until then, disable opening of untrusted .vzt files and run the application under restricted privileges.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115 and test that known malformed VZT samples no longer trigger crashes or unexpected code paths.

Typical attack path

1. Craft a .vzt file containing malformed LZMA varint data sized to overflow the target buffer
2. Deliver the file via email, download link, or shared storage to a target user
3. User opens the file using GTKWave
4. LZMA_read_varint performs the out-of-bounds write and redirects execution to attacker payload

How to detect it

Review system logs and process creation events around GTKWave launches for unexpected child processes, crashes, or shell activity immediately following VZT file access.

What your security team should do

• Block or sandbox GTKWave execution when handling files from external sources
• Deploy application allow-listing or containerization for design tools
• Monitor vendor announcements for an official fixed release and schedule immediate deployment