CVE-2023-37576

What it actually does

Use-after-free in the VCD get_vartoken realloc path within the vcd2vzt conversion utility allows a specially crafted .vcd file to trigger arbitrary code execution.

Why it matters to the business

Processing untrusted waveform files can result in full system compromise for engineers or analysts who rely on the tool, increasing risk of data theft or lateral movement in development environments.

How an attack unfolds

An attacker crafts a malicious .vcd file that exploits the realloc use-after-free during token parsing in vcd2vzt; the victim is tricked into running the conversion utility on the file, resulting in arbitrary code execution.

How to fix it

Update GTKWave to a version containing fixes for the VCD parsing realloc issue once available; otherwise restrict use of vcd2vzt to trusted files only and run the utility under sandboxing or least-privilege constraints.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115 and test vcd2vzt against known-good and sample crafted .vcd files for absence of crashes or unexpected behavior.

Typical attack path

1. Craft malicious .vcd file targeting get_vartoken realloc
2. Deliver file via email, download, or shared storage
3. Victim executes vcd2vzt on the file
4. Use-after-free triggers arbitrary code execution

How to detect it

Review process execution logs for vcd2vzt invoked on .vcd files from untrusted locations; inspect crash dumps or memory artifacts following VCD conversion attempts for signs of exploitation.

• vcd2vzt
• .vcd file processing leading to realloc-related crashes

What your security team should do

• Block or sandbox execution of vcd2vzt on untrusted inputs
• Monitor for new upstream releases and apply fixes promptly
• Educate users on risks of opening waveform files from unknown sources