CVE-2023-38649

What it actually does

Out-of-bounds write during string copy in VZT decompression allows arbitrary code execution when a crafted .vzt file is processed.

Why it matters to the business

Attackers can gain full control of a workstation by tricking an engineer into opening a malicious waveform file, leading to potential theft of intellectual property or further network compromise; no fixed versions are published yet and the flaw has publicly available exploit code.

How an attack unfolds

An attacker creates a specially malformed .vzt file that triggers an unchecked string copy loop inside the VZT reader; when a victim opens the file in GTKWave the loop writes attacker-controlled data beyond buffer bounds and executes arbitrary code.

How to fix it

Upgrade GTKWave to the first patched release once published; in the interim avoid opening .vzt files from untrusted sources and run the application under a restricted user account or sandbox.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115, run vendor-supplied regression tests against known-good and crafted VZT samples, and verify that the decompression path no longer performs unbounded string copies.

Typical attack path

1. Craft malicious .vzt file exploiting the decompression string-copy loop
2. Deliver file via email, download link, or shared storage
3. Victim opens the file with GTKWave
4. Out-of-bounds write executes attacker-supplied payload
5. Establish persistence or exfiltrate data

How to detect it

Review system logs for GTKWave processes opening .vzt files from unusual locations, unexpected child processes spawned by gtkwave, or crashes inside the VZT reader; correlate with file-creation timestamps around the same time.

What your security team should do

• Block or sandbox GTKWave execution on untrusted hosts until a fixed build is available
• Add .vzt file type to email and web-download security policies
• Monitor for new GTKWave releases and expedite deployment once published
• Train hardware and verification teams on the risk of opening waveform files from external parties