CVE-2023-37419

What it actually does

Out-of-bounds write during VCD parse_valuechange processing in the vcd2lxt2 utility allows arbitrary code execution when a crafted .vcd file is opened.

Why it matters to the business

Attackers can fully compromise engineering workstations or build systems that convert waveform files, enabling malware deployment, intellectual-property theft, or lateral movement with no user interaction beyond opening a file.

How an attack unfolds

An attacker creates a malicious .vcd file that triggers the out-of-bounds write inside the portdump value-change parser of vcd2lxt2; when a victim runs the conversion utility on the file, control-flow is hijacked and attacker-supplied code executes.

How to fix it

Disable or remove the vcd2lxt2 binary until a patched build is available; sandbox or restrict execution of any GTKWave conversion utilities; monitor vendor releases for an official fix and apply it immediately upon publication.

How to confirm the fix worked

Confirm vcd2lxt2 is absent or wrapped with execution restrictions; re-test with known-malicious .vcd samples after any update; verify that waveform conversion jobs complete without abnormal memory writes or crashes.

Typical attack path

1. Craft malicious .vcd containing oversized value-change records
2. Deliver file via email, download link, or shared repository
3. Victim executes vcd2lxt2 on the file
4. Out-of-bounds write corrupts memory and redirects execution
5. Attacker payload runs with the privileges of the vcd2lxt2 process

How to detect it

Search EDR and process-creation logs for invocations of vcd2lxt2; inspect command-line arguments that reference .vcd files from untrusted sources; monitor for subsequent suspicious child processes or network connections originating from the same parent.

• vcd2lxt2
• .vcd

What your security team should do

• Block or heavily restrict use of vcd2lxt2 on all systems until a fixed version is released
• Add .vcd files to mail and download gateways for blocking or sandbox detonation
• Harden engineering workstations with application allow-listing for waveform tools
• Hunt for recent execution of vcd2lxt2 in process logs and EDR telemetry