CVE-2023-38620

What it actually does

Integer overflow during allocation of the lsb array in VZT facgeometry parsing allows memory corruption that can be leveraged for arbitrary code execution.

Why it matters to the business

Compromise of engineering workstations that open untrusted waveform files, resulting in loss of control over design data and potential lateral movement.

How an attack unfolds

An attacker creates a malicious .vzt file that triggers the integer overflow when GTKWave parses the facgeometry section; the victim opens the file, the overflow occurs during lsb array allocation, and attacker-controlled code is executed.

How to fix it

Upgrade GTKWave to a version containing fixes for the VZT facgeometry integer overflows. Until upgraded, do not open .vzt files from untrusted sources and consider running the application under restricted permissions or in a sandbox.

How to confirm the fix worked

Confirm the installed GTKWave binary reports a version newer than 3.3.115 and test that the application no longer crashes or exhibits memory corruption when opening a known trigger file.

Typical attack path

1. Craft .vzt file containing oversized facgeometry values that cause integer overflow on lsb allocation
2. Deliver the file via email, download link, or shared storage
3. Victim opens the file in the vulnerable GTKWave application
4. Overflow corrupts memory and redirects execution to attacker payload

How to detect it

Review process creation logs and file-open events for GTKWave accessing .vzt files from unexpected locations; correlate with subsequent crashes or unusual memory-allocation patterns in the application.

What your security team should do

• Prioritize patching GTKWave on all engineering and lab systems that process VZT files
• Block or sandbox opening of .vzt files from external sources until patches are applied
• Add file-type and origin checks to email gateways and file-sharing services