CVE-2023-37573

What it actually does

Use-after-free in the VCD get_vartoken realloc path of the default recoder parser allows an attacker-controlled .vcd file to corrupt heap state and achieve arbitrary code execution when the victim opens the file via the GTKWave GUI.

Why it matters to the business

Engineers and hardware teams that routinely open third-party waveform files risk silent compromise of their workstations, enabling data theft, supply-chain tampering, or further lateral movement inside design environments.

How an attack unfolds

An attacker creates a malicious .vcd file that triggers the use-after-free during recoder-mode parsing of variable tokens; the victim opens the file in GTKWave 3.3.115, the parser reallocates and frees memory while still referencing it, and attacker-controlled data is written into the freed chunk to hijack control flow.

How to fix it

Upgrade GTKWave to the first version containing a fix for the VCD recoder parser (currently unavailable in the provided data); until a patched build is released, open only trusted .vcd files inside a sandboxed or virtualized environment and consider disabling the recoder parser if an option exists.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115 and test that the recoder code path no longer dereferences freed memory when processing known-triggering .vcd samples; monitor upstream commits for the corrected realloc logic.

Typical attack path

1. Craft a .vcd file that exercises the get_vartoken realloc path under recoder parsing
2. Host or email the file to a target who uses GTKWave for waveform inspection
3. Victim opens the file through the GUI
4. Use-after-free triggers during token processing
5. Arbitrary code execution on the local workstation

How to detect it

Review file-open logs and EDR telemetry for gtkwave processes loading .vcd files from untrusted locations; correlate with subsequent suspicious process creation, memory allocation anomalies, or crashes inside the recoder parser.

• gtkwave
• .vcd

What your security team should do

• Treat any untrusted .vcd file as a potential exploit carrier and enforce sandbox execution for GTKWave
• Block or heavily scrutinize inbound .vcd attachments at mail and file-sharing gateways
• Watch for future fixed versions from the GTKWave project and expedite deployment once released
• Add gtkwave to the list of high-risk engineering tools requiring application allow-listing or EDR coverage