CVE-2023-39414

What it actually does

Integer underflow during right-shift in LXT2 radix iteration allows crafted file contents to produce out-of-bounds memory writes, resulting in corruption of the GTKWave process address space.

Why it matters to the business

Users who open untrusted waveform files risk full compromise of the analysis workstation, enabling theft of proprietary design data or lateral movement from the affected machine.

How an attack unfolds

An attacker crafts a malicious .lxt2 file that triggers the underflow in the shift operation; the victim is tricked into opening the file with GTKWave, causing immediate memory corruption that an exploit can turn into arbitrary code execution.

How to fix it

Upgrade GTKWave to a version that corrects the LXT2 radix shift handling; until a fix is available, avoid opening untrusted .lxt2 files and consider sandboxing the application.

How to confirm the fix worked

Confirm the installed GTKWave version is newer than 3.3.115, attempt to open a known-good .lxt2 file, and verify the process does not crash or exhibit abnormal memory behavior on crafted test files.

Typical attack path

1. Attacker generates .lxt2 file containing underflow-triggering radix data
2. Attacker delivers file via email, download, or shared storage
3. Victim opens file in vulnerable GTKWave instance
4. Underflow occurs during lxt2_rd_iter_radix processing
5. Memory corruption is leveraged for code execution or denial of service

How to detect it

Inspect logs or EDR telemetry for GTKWave processes opening .lxt2 files from untrusted locations, unexpected crashes, or memory-protection violations immediately after file open events.

• gtkwave.*\.lxt2
• lxt2_rd_iter_radix

What your security team should do

• Block or filter untrusted .lxt2 files at mail and file-share gateways
• Deploy application allow-listing or sandboxing for waveform viewers
• Monitor for GTKWave crashes when .lxt2 files are opened
• Plan upgrade as soon as a corrected release is published