CVE-2023-39444

What it actually does

Out-of-bounds write during string copy loop in LXT2 parsing allows memory corruption leading to arbitrary code execution.

Why it matters to the business

Attackers can fully compromise user workstations running the affected waveform viewer by delivering a malicious data file, risking data theft, persistence, or lateral movement with no listed patches available after nearly three years.

How an attack unfolds

An attacker crafts a malicious .lxt2 file that triggers the string-copy out-of-bounds write; the victim opens the file in GTKWave, causing memory corruption and arbitrary code execution with no authentication required.

How to fix it

Upgrade GTKWave to the latest available version that resolves LXT2 parsing issues; if no update exists, restrict the application to trusted files only or replace it with an alternative viewer.

How to confirm the fix worked

Confirm current GTKWave version, attempt to open known-good LXT2 files in a controlled environment, and retest after any upgrade for absence of crashes or unexpected memory writes.

Typical attack path

1. Craft malicious LXT2 file exploiting string copy loop
2. Deliver file via email, web download, or shared storage
3. Victim opens file in vulnerable GTKWave instance
4. Out-of-bounds write executes attacker-controlled code

How to detect it

Review application crash logs, process creation events, and file-open telemetry for GTKWave when .lxt2 files are accessed; correlate with unexpected child processes or memory anomalies.

What your security team should do

• Immediately restrict GTKWave execution to trusted files only
• Monitor for upstream patches and deploy as soon as released
• Block or sandbox opening of .lxt2 files from untrusted sources
• Educate users on the risk of opening waveform files from unknown origins