CVE-2023-39270

What it actually does

Integer overflow during allocation of the rows array in LXT2 facgeometry parsing leads to heap memory corruption and arbitrary code execution.

Why it matters to the business

Compromise of engineering workstations that analyze waveform data, enabling attackers to run code and potentially exfiltrate or alter sensitive design files.

How an attack unfolds

An attacker crafts a malicious LXT2 file that triggers an integer overflow in the facgeometry rows array allocation inside GTKWave; when a victim opens the file, the overflow corrupts memory and allows the attacker-supplied payload to execute.

How to fix it

Upgrade GTKWave to a version containing fixes for LXT2 parsing integer overflows once released; in the interim restrict opening of untrusted LXT2 files and consider disabling LXT2 support.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115 and test that crafted LXT2 files no longer trigger the overflow during facgeometry parsing.

Typical attack path

1. Craft LXT2 file containing oversized facgeometry data to trigger rows array integer overflow
2. Deliver the file via email, download, or shared storage
3. Victim opens the file with GTKWave
4. Overflow occurs during parsing, memory is corrupted, and attacker code executes

How to detect it

Inspect system logs and process creation events for GTKWave launching with LXT2 files from unusual locations; look for segmentation faults or heap-related crashes shortly after file open.

• gtkwave.*\.lxt2
• facgeometry
• rows array allocation

What your security team should do

• Block or sandbox GTKWave execution on high-value systems until patched
• Enforce file-type allow-listing that excludes LXT2 files from untrusted sources
• Monitor for new GTKWave releases and expedite deployment when fixes appear