CVE-2023-38623

What it actually does

Integer overflow during allocation of the vindex_offset array in VZT facgeometry parsing leads to memory corruption that enables arbitrary code execution.

Why it matters to the business

Compromise of user workstations running the affected waveform viewer when a malicious file is opened, enabling full system takeover with no patch currently published.

How an attack unfolds

An attacker crafts a VZT file that triggers the integer overflow in facgeometry parsing; when a victim opens the file in GTKWave the overflow corrupts heap memory and redirects execution to attacker-controlled code. Public exploit code is available.

How to fix it

Update to a patched version of GTKWave once released; in the interim avoid opening untrusted .vzt files and run the application under least-privilege or sandboxed conditions.

How to confirm the fix worked

Verify GTKWave version is newer than 3.3.115 and test that a known-malicious VZT sample no longer triggers the overflow or crashes the process.

Typical attack path

1. Craft malicious .vzt file containing oversized facgeometry data
2. Deliver file via email, download link, or shared storage
3. Victim opens file in vulnerable GTKWave instance
4. Integer overflow occurs during vindex_offset allocation
5. Memory corruption leads to arbitrary code execution

How to detect it

Inspect process crash logs or memory dumps for heap corruption patterns immediately after opening a VZT file; correlate file-open events with subsequent unexpected process behavior or network activity.

What your security team should do

• Block untrusted .vzt files at email gateways and file-sharing services
• Monitor for new GTKWave releases and deploy immediately upon availability
• Restrict execution of GTKWave to isolated analysis environments