CVE-2023-38650

What it actually does

Integer overflow during VZT times parsing when num_time_ticks is nonzero leads to memory corruption in GTKWave's vzt_rd_block_vch_decode function.

Why it matters to the business

Attackers can achieve arbitrary code execution on analyst workstations that process untrusted waveform files, potentially exposing proprietary design data or enabling lateral movement.

How an attack unfolds

An attacker crafts a malicious VZT file that triggers an integer overflow in the num_time_ticks handling path. The victim opens the file with GTKWave, causing memory corruption that the attacker leverages for code execution.

How to fix it

Upgrade GTKWave to a version that corrects the VZT parsing integer overflows. Until a fixed release is available, do not open VZT files from untrusted sources and consider sandboxing the application.

How to confirm the fix worked

Confirm the installed GTKWave version is newer than 3.3.115 and test that crafted VZT samples no longer trigger crashes or corruption in vzt_rd_block_vch_decode.

Typical attack path

1. Attacker generates a VZT file with crafted num_time_ticks values
2. Attacker delivers the file via email, download, or shared storage
3. Victim opens the file in GTKWave
4. Integer overflow occurs during block decoding
5. Memory corruption is exploited to execute attacker-controlled code

How to detect it

Review file-open logs and process creation events for GTKWave invocations involving externally sourced VZT files; look for crashes or unexpected memory allocations during VZT decoding.

What your security team should do

• Block opening of .vzt files from external sources until patched
• Monitor for GTKWave updates and deploy immediately when available
• Add application sandboxing or execution restrictions for waveform viewers