CVE-2023-36864

What it actually does

Integer overflow during temp_signal_value_buf allocation in fstReaderIterBlocks2 allows out-of-bounds memory access leading to arbitrary code execution when parsing a crafted .fst waveform file.

Why it matters to the business

Compromise of analyst workstations that open untrusted waveform files can result in full system takeover, loss of sensitive design data, and potential lateral movement within engineering environments.

How an attack unfolds

An attacker crafts a malicious .fst file that triggers the integer overflow in the block reader; the victim opens the file in GTKWave, causing the overflowed allocation and subsequent memory corruption that yields arbitrary code execution.

How to fix it

Upgrade GTKWave to the latest available version that resolves the integer overflow; until a fix is released, avoid opening .fst files from untrusted sources and consider sandboxing or alternative waveform viewers.

How to confirm the fix worked

Confirm GTKWave version is updated past the vulnerable release; attempt to open known-good and boundary .fst files to verify allocation behavior remains stable.

Typical attack path

1. Craft malicious .fst file exploiting integer overflow in fstReaderIterBlocks2
2. Deliver file via email, download link, or shared storage
3. Victim opens file in vulnerable GTKWave instance
4. Overflow leads to memory corruption and attacker-controlled code execution

How to detect it

Review file-access logs and process-creation events for GTKWave opening .fst files from unusual locations; inspect crash dumps or memory-corruption artifacts around fstReaderIterBlocks2.

What your security team should do

• Block or quarantine untrusted .fst attachments at email and file-share gateways
• Inventory all GTKWave installations and prioritize upgrade once a patched build is published
• Configure application allow-listing or sandbox execution for waveform analysis tools
• Monitor for new GTKWave releases and EPSS score changes