CVE-2023-37444

What it actually does

Out-of-bounds read in the VCD variable definition parsing code allows a malicious .vcd file opened through the GUI to corrupt memory and achieve arbitrary code execution.

Why it matters to the business

An attacker who convinces a user to open a crafted waveform file can gain full control of the workstation, leading to data theft, ransomware deployment, or lateral movement with moderate urgency given the low EPSS and lack of known exploitation campaigns.

How an attack unfolds

An attacker creates a specially crafted .vcd file that triggers an out-of-bounds read during interactive VCD parsing; the file is delivered to a victim who opens it in GTKWave, causing memory corruption that the attacker turns into code execution.

How to fix it

Upgrade GTKWave to the latest available version that resolves the VCD parsing issues; if no newer release exists, restrict use of untrusted .vcd files and consider alternative waveform viewers until a fix is released.

How to confirm the fix worked

Confirm the installed GTKWave version is newer than 3.3.115, attempt to load known-good .vcd files, and verify that the application no longer exhibits memory errors or crashes when processing test cases that previously triggered the flaw.

Typical attack path

1. Craft a malicious .vcd file that triggers the out-of-bounds read in the var definition section
2. Deliver the file to the target via email, download link, or shared storage
3. Victim opens the file using GTKWave's GUI VCD loader
4. Out-of-bounds read occurs during parsing, leading to memory corruption and arbitrary code execution

How to detect it

Review system and application logs for GTKWave crashes or abnormal exits while loading .vcd files; inspect recent file-access history for .vcd files originating from external sources and correlate with unexpected process behavior or network activity after file open events.

• gtkwave
• .vcd

What your security team should do

• Immediately restrict opening of .vcd files from untrusted sources
• Monitor for availability of a patched GTKWave release and deploy it enterprise-wide
• Add file-type restrictions or sandboxing for waveform analysis tools
• Educate users on the risks of opening files from unknown origins