CVE-2023-38621

What it actually does

Integer overflow during allocation of the `flags` array in VZT facgeometry parsing leads to undersized buffer and subsequent memory corruption that can be leveraged for arbitrary code execution.

Why it matters to the business

Users who open malicious waveform files can have their workstations compromised, enabling data theft, persistence, or further lateral movement inside the organization; the issue affects any environment that relies on this analysis tool for hardware or firmware debugging.

How an attack unfolds

An attacker crafts a VZT file that triggers the integer overflow when the facgeometry section is parsed; the victim opens the file with the vulnerable application, causing the overflow, memory corruption, and ultimately execution of attacker-supplied code.

How to fix it

Upgrade to a patched release of GTKWave once available; until then restrict the application to trusted files only and consider sandboxing or disabling the VZT parser.

How to confirm the fix worked

Confirm the installed version is newer than the vulnerable release; attempt to open a known test case that exercises facgeometry parsing and verify no crash or unexpected behavior occurs.

Typical attack path

1. Generate malicious VZT file that triggers integer overflow in facgeometry flags allocation
2. Deliver file via email, download link, or shared storage
3. Victim opens file in the affected waveform viewer
4. Overflow corrupts memory structures leading to code execution

How to detect it

Review system logs and EDR telemetry for GTKWave processes that open VZT files from unusual locations or that exhibit memory corruption signals such as crashes shortly after file load.

What your security team should do

• Block or sandbox opening of VZT files from untrusted sources
• Monitor vendor announcements for an official fixed release
• Add file-type and process-creation rules to EDR to alert on GTKWave handling external VZT content