CVE-2023-35996

Vulnerability

The vulnerability resides in the fstReaderIterBlocks2 function's tdelta handling within GTKWave version 3.3.115 [1]. Specifically, improper validation of array indices occurs when signal_lens is zero, allowing out-of-bounds access. This code path is triggered when a user opens a specially crafted .fst file using GTKWave's file parsing routines.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious .fst file with manipulated tdelta indexing [1]. No authentication or special privileges are required; the victim only needs to open the file (e.g., by double-clicking it in a file manager or via GTKWave's open dialog). The attack is local and relies on user interaction.

Impact

Successful exploitation leads to arbitrary code execution in the context of the user running GTKWave. This can result in full compromise of confidentiality, integrity, and availability of the affected system.

Mitigation

As of the advisory publication date (2024-01-08), no patched version of GTKWave has been released [1]. Users are advised to avoid opening .fst files from untrusted sources until a fix is available. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.