CVE-2023-37445

What it actually does

Out-of-bounds write in the VCD var definition section handler of the vcd2vzt conversion utility allows an attacker-supplied .vcd file to corrupt memory and achieve arbitrary code execution.

Why it matters to the business

Users who open untrusted waveform files with GTKWave or its conversion tools risk complete compromise of the local workstation, potentially exposing proprietary hardware designs and enabling lateral movement in engineering environments.

How an attack unfolds

An attacker crafts a malicious .vcd file that triggers an out-of-bounds write when processed by vcd2vzt; the victim opens the file or runs the conversion utility, causing the process to execute attacker-controlled code.

How to fix it

Upgrade GTKWave to the latest available version that resolves the VCD parsing issues; until a fix is released, avoid processing untrusted .vcd files with vcd2vzt and run the utility inside a sandbox or virtual machine.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115 and test that vcd2vzt rejects or safely handles the previously crashing VCD sample; monitor vendor release notes for the patch.

Typical attack path

1. Attacker generates specially crafted .vcd file exploiting the var definition parsing flaw
2. Victim receives the file via email, download, or shared storage
3. Victim invokes GTKWave or vcd2vzt on the file
4. Out-of-bounds write occurs during parsing, leading to code execution

How to detect it

Search process-creation logs for vcd2vzt invocations on files originating outside the organization; inspect crash dumps or segmentation-fault records containing GTKWave or vcd2vzt for memory-corruption signatures.

What your security team should do

• Block or quarantine untrusted .vcd and .vzt files at email and file-share gateways
• Restrict use of vcd2vzt to isolated analysis hosts until a fixed build is deployed
• Add GTKWave to the organization's application allow-list with mandatory sandbox execution
• Subscribe to GTKWave release announcements for prompt patching