CVE-2023-37447

What it actually does

Out-of-bounds read and subsequent out-of-bounds write during parsing of the VCD var definition section in the vcd2lxt conversion utility, allowing an attacker-controlled .vcd file to corrupt memory and achieve arbitrary code execution.

Why it matters to the business

Opening a malicious waveform file with the affected utility can fully compromise the workstation, enabling data theft, persistence, or lateral movement with no prior authentication required.

How an attack unfolds

An attacker crafts a .vcd file that triggers the out-of-bounds write in the var definition parser inside vcd2lxt; the victim opens the file locally, the utility processes the malformed input, memory corruption occurs, and attacker-supplied code executes with the privileges of the user running the tool.

How to fix it

Upgrade GTKWave to the latest available version that resolves the VCD parsing issues; if no patched release exists, replace the utility with an unaffected alternative and block execution of vcd2lxt on untrusted files via application allow-listing.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115 and test that vcd2lxt rejects or safely handles the previously crashing VCD constructs; review build logs or package manifests for the corrected parser code.

Typical attack path

1. Create malicious .vcd file exploiting VCD var definition parsing
2. Deliver file via email, download, or shared storage
3. Victim opens file with GTKWave or invokes vcd2lxt on it
4. Out-of-bounds write corrupts memory and redirects execution
5. Attacker payload executes arbitrary code on the system

How to detect it

Search process creation logs for vcd2lxt or gtkwave invocations against files originating outside trusted directories; examine crash dumps or memory dumps for VCD parser faults; review file-access and execution telemetry for .vcd files received via email or web.

• vcd2lxt
• .vcd file opened from Downloads or email attachments
• GTKWave segmentation fault or abnormal termination while parsing VCD

What your security team should do

• Immediately restrict use of vcd2lxt and GTKWave to trusted files only
• Deploy application control to prevent execution on unvetted .vcd files
• Monitor for new upstream releases and schedule upgrade within 30 days
• Educate engineering teams on risks of opening waveform files from external sources