#VU85120 Improper Validation of Array Index in GTKWave - CVE-2023-34087
Published: January 9, 2024
Vulnerability identifier: #VU85120
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2023-34087
CWE-ID: CWE-129
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
GTKWave
GTKWave
Software vendor:
gtkwave
gtkwave
Description
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error in the EVCD var len parsing functionality. A remote attacker can
create a specially crafted .evcd file, trick the victim into opening it
using the affected software, trigger an array index error and execute arbitrary code on the system.
Remediation
Install updates from vendor's website.