CVE-2023-37575

What it actually does

Use-after-free condition in VCD get_vartoken realloc during interactive GUI parsing of a specially crafted .vcd file leads to arbitrary code execution.

Why it matters to the business

Attackers can fully compromise developer or engineer workstations that open untrusted waveform files, resulting in data theft, persistent malware, or lateral movement with high urgency due to publicly available exploits more than two years after disclosure and no listed fixes.

How an attack unfolds

An attacker creates a malicious .vcd file that triggers the use-after-free in GTKWave's interactive VCD parsing path; the victim opens the file through the GUI, causing the realloc to reuse freed memory and allowing control of execution flow for code execution.

How to fix it

No fixed versions are listed; replace or isolate GTKWave installations, avoid opening any untrusted .vcd files, and monitor for upstream updates from the project.

How to confirm the fix worked

Confirm GTKWave version is not 3.3.115 or earlier vulnerable builds, test that crafted VCD files no longer trigger crashes or code execution in the GUI parser, and verify process isolation or removal of the application.

Typical attack path

1. Craft malicious .vcd file exploiting VCD get_vartoken realloc use-after-free
2. Deliver file via email, download, or shared storage
3. Victim opens file in GTKWave GUI triggering interactive VCD parsing
4. Use-after-free occurs during token reallocation
5. Attacker gains arbitrary code execution on the system

How to detect it

Review system and application logs for GTKWave crashes or unexpected memory errors during .vcd loading, correlate with file-access events to suspicious VCD files, and inspect for post-execution artifacts such as new processes or network connections initiated by the GTKWave binary.

• gtkwave.*.vcd
• use-after-free
• get_vartoken

What your security team should do

• Immediately restrict GTKWave use to trusted .vcd files only
• Remove or sandbox the application on high-risk systems given available exploits and long disclosure window
• Harden email and file-sharing controls to block .vcd attachments
• Monitor vendor or community channels for any future patched releases