Cloudanix VulnDB

CVE-2023-37416

High · 7.8

CVSS

7.8

EPSS

0.4%

Published

Jan 8, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A specially made data file can let an attacker take over a computer when someone opens it in this waveform viewing program.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in legacy VCD parsing code within the parse_valuechange portdump functionality allows arbitrary code execution when a crafted .vcd file is processed through the GUI.

Why it matters to the business

Compromise of engineering workstations that open untrusted waveform files can lead to full system takeover, data theft, or deployment of persistent malware with high operational disruption for hardware design and verification teams.

How an attack unfolds

An attacker crafts a malicious .vcd file that triggers the out-of-bounds write during legacy VCD parsing; the victim opens the file via the GTKWave GUI, causing the flaw to execute attacker-controlled code.

How to fix it

Upgrade GTKWave to a version containing fixes for the VCD parsing issues; if no patched release is available, restrict use to trusted files only and sandbox the application.

How to confirm the fix worked

Confirm the installed GTKWave binary version, test opening known-good .vcd files after upgrade, and verify absence of the vulnerable parse_valuechange code path via source review or binary diffing.

Typical attack path

  1. Craft a .vcd file containing malformed valuechange data sized to overflow the portdump buffer
  2. Deliver the file via email, download link, or shared repository to a target user
  3. Victim opens the file using the GTKWave GUI legacy VCD loader
  4. Out-of-bounds write occurs and redirects execution to attacker payload
  5. Attacker gains code execution on the local system

How to detect it

Review file-open logs and process creation events for GTKWave invocations involving externally sourced .vcd files; inspect recent .vcd files for anomalous size or structure around valuechange sections.

What your security team should do

  • Immediately restrict opening of .vcd files from untrusted sources
  • Monitor for GTKWave updates and apply any available patched builds
  • Add application sandboxing or containerization for waveform viewers
  • Educate hardware and verification teams on file-origin risks

The record

Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the GUI's legacy VCD parsing code.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 gtkwave 0 3.3.98+really3.3.118-0+deb10u1
Debian:11 gtkwave 0 3.3.104+really3.3.118-0+deb11u1
Debian:12 gtkwave 0 3.3.118-0.1~deb12u1
Debian:13 gtkwave 0 3.3.118-0.1
Ubuntu:16.04:LTS gtkwave 0 No fix
Ubuntu:18.04:LTS gtkwave 0 No fix
Ubuntu:20.04:LTS gtkwave 0 No fix
Ubuntu:22.04:LTS gtkwave 0 No fix
Ubuntu:24.04:LTS gtkwave 0 No fix
Ubuntu:24.10 gtkwave 0 No fix
Ubuntu:25.04 gtkwave 0 No fix
Ubuntu:25.10 gtkwave 0 No fix
Ubuntu:Pro:16.04:LTS gtkwave 0 No fix
Ubuntu:Pro:18.04:LTS gtkwave 0 No fix
Ubuntu:Pro:20.04:LTS gtkwave 0 No fix

Related vulnerabilities