CVE-2023-36916

Vulnerability

An integer overflow vulnerability exists in the fstReaderIterBlocks2 function's chain_table_lengths array allocation within GTKWave 3.3.115 [1]. The flaw occurs when parsing a specially crafted .fst file, leading to a heap buffer overflow. The vulnerable code path is reachable when the application opens a malicious file, either via the GUI or command-line tools.

Exploitation

An attacker can exploit this vulnerability by providing a crafted .fst file to a victim. The victim must open the file using GTKWave, which can occur through double-clicking the file or using the gtkwave command. No authentication or special privileges are required [1]. The attack is local, but the file can be delivered via email or other means.

Impact

Successful exploitation allows an attacker to achieve arbitrary code execution in the context of the victim's user account. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system [1].

Mitigation

As of the publication date, no official patch or fixed version has been released by the vendor. Users are advised to avoid opening untrusted .fst files with GTKWave 3.3.115 until a fix is available [1].