CVE-2023-37282

What it actually does

Out-of-bounds write in the VZT LZMA_Read dmem extraction path allows arbitrary code execution when parsing a malicious file.

Why it matters to the business

Compromise of the workstation used to view waveform files can lead to full system takeover, data theft, or lateral movement; high prevalence of the affected viewer in hardware and EDA workflows increases exposure surface.

How an attack unfolds

An attacker crafts a malicious .vzt file that triggers the out-of-bounds write during LZMA decompression; the victim opens the file in the vulnerable viewer, resulting in arbitrary code execution. Public exploit code is available and the flaw has been known for years.

How to fix it

Upgrade to a version containing the fix for the VZT parser once released; until then, avoid opening untrusted .vzt files and run the viewer under reduced privileges or in a sandbox. Monitor vendor releases for patched builds.

How to confirm the fix worked

Confirm the installed GTKWave binary version is newer than 3.3.115 and test that a known-malicious .vzt sample no longer causes memory corruption or crashes the process.

Typical attack path

1. Craft a .vzt file containing a malicious LZMA stream that overflows the dmem buffer
2. Deliver the file via email, download link, or shared storage
3. Victim opens the file with the vulnerable GTKWave application
4. OOB write executes attacker-supplied code with the privileges of the user

How to detect it

Review process creation logs and file-open events for GTKWave accessing .vzt files from untrusted sources; look for crashes or unexpected child processes spawned by the viewer shortly after file access.

• gtkwave.*\.vzt
• LZMA_Read
• VZT file open
• out-of-bounds write crash in gtkwave

What your security team should do

• Block or sandbox execution of GTKWave on untrusted .vzt files immediately
• Inventory all systems running the affected viewer and prioritize upgrade when a fixed build is published
• Add file-type and process execution telemetry for .vzt handling to EDR rules
• Educate hardware and verification teams on the risk of opening externally sourced waveform files