CVE-2023-38648

Vulnerability

The vulnerability is an out-of-bounds write in the vzt_rd_get_facname decompression function of GTKWave 3.3.115 [1]. It occurs during a prefix copy loop when parsing a specially crafted .vzt file. The issue affects the VZT file format handling and can be triggered by opening a malicious file.

Exploitation

An attacker must convince a victim to open a malicious .vzt file, for example via email or file sharing [1]. No authentication or special network access is required. The victim only needs to use GTKWave to open the file, which may happen automatically if the file type is associated with GTKWave.

Impact

Successful exploitation leads to arbitrary code execution in the context of the user running GTKWave [1]. This can result in full compromise of confidentiality, integrity, and availability of the affected system.

Mitigation

As of the publication date, no fixed version has been announced in the available references [1]. Users should avoid opening untrusted .vzt files and consider using alternative tools or sandboxing until a patch is released.