CVE-2023-39235

What it actually does

Out-of-bounds write during VZT block autosort when iterating lt->num_time_ticks in gtkwave allows arbitrary code execution upon opening a crafted .vzt file.

Why it matters to the business

An attacker who tricks a user into opening a malicious waveform file can gain full control of the affected system, leading to data theft, ransomware deployment, or lateral movement; the vulnerability remains unpatched in listed releases despite public exploit availability for over two years.

How an attack unfolds

An attacker creates a specially crafted .vzt file that triggers an out-of-bounds write inside the autosort loop; the file is delivered via email, download, or shared storage; the victim opens it with gtkwave; the write corrupts memory and redirects execution to attacker-controlled code.

How to fix it

Upgrade gtkwave to the latest available version as soon as a fix is released; in the interim, avoid opening any untrusted .vzt files and consider sandboxing or disabling the VZT reader entirely.

How to confirm the fix worked

Confirm gtkwave version is newer than 3.3.115 and test that the num_time_ticks loop bounds checks are present; attempt to open a known-good .vzt file and verify no crash or unexpected memory writes occur.

Typical attack path

1. Craft malicious .vzt file exploiting num_time_ticks loop
2. Deliver file to target via phishing or shared storage
3. Victim opens file in gtkwave
4. Trigger out-of-bounds write during VZT processing
5. Achieve arbitrary code execution on the system

How to detect it

Review system logs and file-access records for gtkwave opening .vzt files from unusual locations; inspect crash dumps or memory corruption indicators around gtkwave process termination; correlate with known malicious file hashes if available from threat feeds.

• gtkwave
• .vzt
• vzt_rd_process_block

What your security team should do

• Immediately block opening of .vzt files from untrusted sources
• Monitor for new gtkwave releases and deploy once fixed versions are published
• Add gtkwave to application allow-listing with strict file-type controls
• Educate users on risks of opening waveform files from unknown origins