CVE-2023-37417

What it actually does

Out-of-bounds write during VCD parse_valuechange portdump processing in GTKWave allows arbitrary code execution when a crafted .vcd file is opened via the GUI interactive parser.

Why it matters to the business

Users who open untrusted waveform files can have their workstations compromised, enabling data theft, persistence, or lateral movement with no patch versions listed.

How an attack unfolds

An attacker creates a malicious .vcd file that triggers the out-of-bounds write in the VCD parsing code; the victim opens the file in GTKWave through the GUI, causing the parser to write attacker-controlled data outside bounds and execute arbitrary code.

How to fix it

Upgrade GTKWave to the latest available version as soon as a fix is released; until then, do not open VCD files from untrusted sources and consider running the application under restricted permissions or sandboxing.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115 and test that known-malicious VCD samples no longer cause crashes or unexpected memory writes; monitor vendor release notes for the addressed issue.

Typical attack path

1. Craft malicious .vcd file that triggers OOB write in parse_valuechange
2. Deliver file to target via email, download, or shared storage
3. Victim opens file using GTKWave GUI interactive VCD loader
4. Parser executes attacker-supplied code with user privileges

How to detect it

Review system logs and file-access records for unexpected GTKWave launches against recently received .vcd files; inspect crash dumps or memory-corruption indicators tied to GTKWave processes handling VCD input.

What your security team should do

• Block or sandbox GTKWave execution on endpoints that do not require it
• Implement file-type restrictions and user training to avoid untrusted .vcd files
• Track upstream GTKWave releases and deploy updates immediately when available
• Add .vcd file handling to application allow-listing policies where feasible