CVE-2023-39235

Summary

CVE-2023-39235 is a critical vulnerability affecting GTKWave 3.3.115. The issue involves multiple out-of-bounds write vulnerabilities in the vzt_rd_process_block autosort functionality. A crafted .vzt file can exploit these vulnerabilities, leading to arbitrary code execution. The vulnerability arises when processing the number of time ticks (lt->num_time_ticks), allowing an attacker to write data beyond the allocated memory. To trigger this issue, a victim must open a malicious file.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.