CVE-2023-39275

What it actually does

Integer overflow during allocation of the `value` array in LXT2 facgeometry parsing allows out-of-bounds memory access and arbitrary code execution when a crafted .lxt2 file is opened.

Why it matters to the business

Attackers can gain full control of a user's workstation by tricking them into opening a malicious waveform file, leading to data theft, ransomware deployment, or further network compromise in environments that rely on GTKWave for signal analysis.

How an attack unfolds

An attacker creates a specially crafted .lxt2 file that triggers an integer overflow in the facgeometry value-array allocation routine. The victim is induced to open the file in GTKWave 3.3.115, causing the overflow to corrupt memory and execute attacker-supplied code.

How to fix it

Upgrade GTKWave to a version that corrects the LXT2 facgeometry parsing integer overflow. Until a fixed build is available, disable LXT2 import or restrict the application to trusted files only.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115, run the application against known-good and known-malicious LXT2 test files, and verify that the value-array allocation no longer overflows.

Typical attack path

1. Craft malicious .lxt2 file exploiting the facgeometry integer overflow
2. Deliver file via email, download link, or shared storage
3. Victim opens file with vulnerable GTKWave instance
4. Overflow occurs during array allocation leading to code execution

How to detect it

Review file-open logs and process-creation events for GTKWave accessing .lxt2 files from untrusted locations; look for subsequent crashes, unexpected child processes, or memory-corruption indicators shortly after file load.

What your security team should do

• Immediately restrict GTKWave usage to verified files and consider alternative tools until patched builds are released
• Add .lxt2 file-type blocking rules at email and web gateways
• Monitor for any public exploit samples given the ExploitAvailable maturity rating