CVE-2023-37577

What it actually does

Use-after-free in the VCD get_vartoken realloc functionality of GTKWave allows arbitrary code execution when a specially crafted .vcd file is processed via the vcd2lxt2 conversion utility.

Why it matters to the business

Successful exploitation grants attackers full system control after a user opens a malicious file, enabling data theft, persistence, or further compromise with moderate urgency given low EPSS and no known ransomware usage.

How an attack unfolds

An attacker crafts a malicious .vcd file that triggers the realloc-related use-after-free during vcd2lxt2 processing; the victim is then tricked into opening the file, resulting in arbitrary code execution.

How to fix it

Upgrade affected GTKWave installations to a fixed version; for strapi/strapi (GIT) apply commit e1dfd4d9f1cab25cf6da3614c1975e4e508e01c6.

How to confirm the fix worked

Verify the installed GTKWave version is newer than 3.3.115 and test that vcd2lxt2 no longer crashes or executes unexpected code on known-bad .vcd samples.

Typical attack path

1. Craft .vcd file exploiting realloc use-after-free
2. Deliver file to target via email or download
3. Victim opens file using vcd2lxt2 utility
4. Trigger use-after-free to achieve code execution

How to detect it

Review system logs and process execution history for invocations of vcd2lxt2 against recently received .vcd files; look for unexpected crashes or child processes spawned from the utility.

What your security team should do

• Apply the listed fixed commit or upgrade GTKWave immediately
• Block or sandbox untrusted .vcd file handling
• Monitor for any new exploit maturity increases