CVE-2023-37446

What it actually does

Out-of-bounds write in the VCD variable definition parsing code of the vcd2lxt2 utility allows a malformed .vcd file to corrupt memory and achieve arbitrary code execution when the file is processed.

Why it matters to the business

Users or automated pipelines that convert waveform files with the affected utility risk silent compromise of engineer workstations or build systems, potentially leading to loss of intellectual property or insertion of persistent malware into design environments.

How an attack unfolds

An attacker crafts a .vcd file that triggers the out-of-bounds write inside the variable-definition section handler. The victim opens the file (or an automated process invokes vcd2lxt2 on it), causing the utility to write attacker-controlled data beyond allocated buffers and execute arbitrary code under the privileges of the invoking user.

How to fix it

Upgrade GTKWave to a version that corrects the VCD parsing logic in vcd2lxt2. If no patched release is available, replace the utility with an unaffected waveform converter or isolate file-conversion tasks inside a sandboxed or virtualized environment that cannot reach sensitive resources.

How to confirm the fix worked

Confirm the installed GTKWave binary reports a version containing the upstream fix for the VCD variable-definition handler; re-process a known-malicious test .vcd file inside an isolated environment and verify that no memory corruption or code execution occurs.

Typical attack path

1. Attacker prepares a malicious .vcd file containing a corrupted variable-definition section sized to overflow internal buffers.
2. Victim receives the file via email, download, or shared repository and opens it or runs vcd2lxt2 against it.
3. vcd2lxt2 parses the malformed section, performs an out-of-bounds write, and transfers control to attacker-supplied shellcode.
4. Attacker gains code execution on the victim machine and proceeds with further actions such as credential theft or lateral movement.

How to detect it

Search process-creation logs for invocations of vcd2lxt2 or gtkwave that reference externally supplied .vcd files; inspect crash or segmentation-fault reports on engineering workstations that coincide with .vcd file access; examine recent file-system artifacts with .vcd extensions that were created or downloaded shortly before anomalous process behavior.

What your security team should do

• Immediately restrict or disable the vcd2lxt2 utility on developer and CI systems until a fixed GTKWave package is deployed.
• Add .vcd file-type scanning to mail gateways and repository commit hooks to block or quarantine suspicious waveform files.
• Monitor for any remaining instances of GTKWave 3.3.115 or earlier and prioritize replacement.