CVE-2023-39273

What it actually does

Integer overflow during allocation of the `flags` array in LXT2 facgeometry parsing allows out-of-bounds memory access and corruption, enabling arbitrary code execution.

Why it matters to the business

Compromise of analyst or engineering workstations that open waveform files can lead to loss of control over those systems and any data or credentials present on them.

How an attack unfolds

An attacker creates a malformed .lxt2 file that triggers the integer overflow when GTKWave parses the facgeometry section. The victim opens the file, the overflow occurs during flags array allocation, and attacker-controlled data is written beyond the allocated buffer, hijacking control flow for code execution.

How to fix it

Upgrade GTKWave to a version that corrects the LXT2 facgeometry parsing integer overflow. Until a fixed release is available, do not open untrusted .lxt2 files and consider disabling or sandboxing the application.

How to confirm the fix worked

Confirm the installed GTKWave version is newer than 3.3.115 and that LXT2 files with large facgeometry sections no longer cause abnormal memory allocation or crashes under controlled testing.

Typical attack path

1. Craft a malicious .lxt2 file that overflows the flags array allocation
2. Deliver the file via email, download, or shared storage
3. Victim opens the file with the vulnerable GTKWave binary
4. Integer overflow occurs during facgeometry parsing
5. Memory corruption leads to arbitrary code execution

How to detect it

Review process creation logs and file-access telemetry for gtkwave instances opening .lxt2 files from user downloads, email clients, or temporary directories; look for subsequent anomalous child processes or memory-allocation failures.

• gtkwave.*\.lxt2
• facgeometry
• flags array allocation

What your security team should do

• Block or sandbox GTKWave execution on systems that do not require it
• Implement file-type restrictions or mail-gateway filtering for .lxt2 attachments
• Monitor for GTKWave processes opening files from untrusted locations
• Track upstream GTKWave releases for a corrective patch