CVE-2023-37574

What it actually does

Use-after-free condition in the VCD get_vartoken realloc path of the legacy GUI parser allows an attacker-controlled .vcd file to corrupt heap memory and achieve arbitrary code execution.

Why it matters to the business

Compromise of engineering workstations that analyze waveform files can result in theft of proprietary hardware designs, insertion of malicious code into development environments, and lateral movement into design or manufacturing networks.

How an attack unfolds

An attacker crafts a .vcd file that triggers the use-after-free during realloc in the legacy VCD parser; the victim opens the file through the GTKWave GUI, the parser processes the malicious token stream, and the freed memory is reused to execute attacker-supplied code.

How to fix it

Upgrade GTKWave to a version containing the fix for CVE-2023-37574; if no patched release is available, restrict use of the legacy VCD parser and prohibit opening untrusted .vcd files.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115 and that the get_vartoken realloc path has been hardened; attempt to open known-good and known-malicious .vcd samples in an isolated environment to verify absence of crashes or code execution.

Typical attack path

1. Create malicious .vcd file that triggers UAF in get_vartoken realloc
2. Deliver file via email, download, or shared storage
3. Victim opens file using GTKWave GUI legacy VCD loader
4. Heap corruption leads to arbitrary code execution

How to detect it

Review endpoint logs for GTKWave launches immediately followed by crashes or unexpected child processes; examine recent file-access history for .vcd files originating outside trusted design repositories.

What your security team should do

• Immediately block untrusted .vcd files from entering engineering networks
• Inventory all GTKWave installations and enforce updates or removal
• Add .vcd file-type restrictions to email gateways and file-sharing systems
• Monitor for GTKWave process anomalies on developer endpoints