CVE-2023-38619

What it actually does

Integer overflow during allocation of the msb array in VZT facgeometry parsing leads to memory corruption and arbitrary code execution.

Why it matters to the business

Compromise of engineering workstations that process waveform files can result in loss of intellectual property, disruption of hardware design workflows, and lateral movement into development environments.

How an attack unfolds

An attacker crafts a malicious .vzt file that triggers an integer overflow when GTKWave allocates the msb array. The victim opens the file, the overflow occurs during parsing, and attacker-controlled code executes with the privileges of the GTKWave process.

How to fix it

Upgrade GTKWave to the latest available version that resolves the VZT parsing integer overflow. Until a fixed release is obtained, avoid opening untrusted .vzt files and consider sandboxing the application.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115 and test that malformed VZT files no longer trigger allocation overflows or crashes during facgeometry parsing.

Typical attack path

1. Create specially crafted .vzt file that triggers integer overflow in facgeometry parsing
2. Deliver file via email, download, or shared storage
3. Victim opens file with GTKWave
4. Overflow corrupts memory and redirects execution to attacker payload

How to detect it

Review file-access logs and process creation events for GTKWave opening .vzt files from untrusted locations; inspect crash dumps or memory error reports that reference VZT facgeometry or msb array allocation.

What your security team should do

• Block or sandbox GTKWave execution on untrusted .vzt files
• Monitor for new GTKWave releases and deploy updated packages enterprise-wide
• Educate hardware and verification teams on risks of opening external waveform files