CVE-2023-39443

What it actually does

Out-of-bounds write in the prefix copy loop during LXT2 file parsing allows arbitrary code execution when a crafted file is opened.

Why it matters to the business

Attackers can gain full control of affected systems if users open malicious waveform files, risking data theft, ransomware, or persistent access; the issue has been public for over two years with public exploits available.

How an attack unfolds

An attacker creates a specially crafted .lxt2 file that triggers an out-of-bounds write during parsing of the prefix section; the victim is tricked into opening the file in GTKWave, resulting in arbitrary code execution on the local system.

How to fix it

Upgrade GTKWave to the latest available version that resolves LXT2 parsing issues; until a fix is released, do not open untrusted .lxt2 files and consider disabling LXT2 support if possible.

How to confirm the fix worked

Confirm GTKWave version is updated beyond 3.3.115, scan for any remaining vulnerable binaries, and test parsing of sample LXT2 files in a sandboxed environment.

Typical attack path

1. Craft malicious .lxt2 file to trigger prefix copy loop overflow
2. Deliver file via email, download, or shared storage
3. Victim opens file using GTKWave
4. Out-of-bounds write executes attacker-controlled code

How to detect it

Inspect system and application logs for GTKWave crashes or unexpected terminations while processing .lxt2 files; search file system for recently created or downloaded .lxt2 files and correlate with process creation events.

What your security team should do

• Block or sandbox opening of .lxt2 files from untrusted sources
• Monitor vendor announcements for patch release and deploy immediately
• Educate users on risks of opening waveform files from unknown origins
• Review endpoint detection for any historical GTKWave crashes or anomalous child processes