CVE-2023-39413

2024-01-0815:15:24

CWE-191

talos

web.nvd.nist.gov

cve

2023

39413

integer underflow

gtkwave

memory corruption

vulnerability

nvd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

21.5%

JSON

Multiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer underflow when performing the left shift operation.

Affected configurations

Nvd

Vulners

Node

tonybybellgtkwaveMatch3.3.115

VendorProductVersionCPE
tonybybellgtkwave3.3.115cpe:2.3:a:tonybybell:gtkwave:3.3.115:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tonybybell	gtkwave	3.3.115	cpe:2.3:a:tonybybell:gtkwave:3.3.115:::::::*

CNA Affected

[
  {
    "vendor": "GTKWave",
    "product": "GTKWave",
    "versions": [
      {
        "version": "3.3.115",
        "status": "affected"
      }
    ]
  }
]