CVE-2023-39271

What it actually does

Integer overflow during allocation of the msb array in LXT2 facgeometry parsing allows out-of-bounds memory access and subsequent arbitrary code execution when a crafted .lxt2 file is opened.

Why it matters to the business

Compromise of analyst or developer workstations that open waveform files can lead to malware deployment, credential theft, or lateral movement inside engineering environments.

How an attack unfolds

An attacker generates a malicious .lxt2 file containing integer values that trigger an overflow when GTKWave allocates the msb array. The victim opens the file in an affected GTKWave version, the parser performs the faulty allocation, and attacker-controlled data is written beyond intended bounds, resulting in code execution.

How to fix it

Upgrade GTKWave to a version containing the corrected facgeometry parsing logic. Until a fixed release is available, avoid opening .lxt2 files from untrusted sources and consider sandboxing or alternative viewers.

How to confirm the fix worked

Confirm the installed GTKWave version is newer than 3.3.115 and test that a known-malformed .lxt2 sample no longer triggers allocation faults or crashes.

Typical attack path

1. Craft .lxt2 file with oversized facgeometry values that cause msb array integer overflow
2. Deliver the file via email, download link, or shared storage
3. Victim opens the file using GTKWave
4. Parser processes the geometry record and performs the overflowing allocation
5. Memory corruption is leveraged to execute attacker-supplied code

How to detect it

Monitor process creation logs for gtkwave opening .lxt2 files from unusual locations, unexpected child processes spawned by gtkwave, or crash dumps containing LXT2 parsing stack frames.

What your security team should do

• Block or quarantine .lxt2 attachments at mail and file gateways
• Update GTKWave as soon as a patched build is released
• Configure application allow-listing or sandboxing for waveform viewers
• Educate users on risks of opening untrusted simulation files