CVE-2023-37443

What it actually does

Out-of-bounds read in the legacy VCD variable definition section parsing allows arbitrary code execution upon opening a malicious .vcd file via the GUI.

Why it matters to the business

Attackers can achieve code execution on systems where users open untrusted waveform files, risking full compromise; the issue has been public for over two years with exploits available and no listed fixed versions.

How an attack unfolds

An attacker crafts a .vcd file that triggers an out-of-bounds read in the legacy VCD parsing code. The victim opens the file through the GTKWave GUI, causing the vulnerability to activate and resulting in arbitrary code execution.

How to fix it

Do not open .vcd files from untrusted sources. Monitor for GTKWave updates addressing VCD parsing vulnerabilities and migrate to a patched release once available. Consider sandboxing the application or using alternative viewers in the interim.

How to confirm the fix worked

Confirm current GTKWave version against vendor releases. Test file handling behavior with untrusted .vcd samples in an isolated environment and verify absence of out-of-bounds access during parsing.

Typical attack path

1. Craft malicious .vcd file exploiting VCD var definition out-of-bounds read
2. Deliver file to target user
3. User opens file using GTKWave GUI
4. Legacy VCD parsing triggers out-of-bounds read
5. Achieve arbitrary code execution

How to detect it

Monitor system and application logs for GTKWave crashes or memory errors during .vcd file processing. Search for unexpected child processes or network activity spawned from the gtkwave binary after file open events.

• gtkwave
• .vcd
• legacy VCD parsing
• out-of-bounds read in VCD var definition

What your security team should do

• Block or sandbox GTKWave when handling files from external sources
• Educate users on risks of opening untrusted waveform files
• Track upstream GTKWave releases for VCD parsing fixes
• Implement file-type restrictions or content scanning for .vcd files