CVE-2023-37578

What it actually does

Use-after-free condition in VCD get_vartoken realloc handling allows an attacker-supplied .vcd file to corrupt heap metadata during vcd2lxt conversion and achieve arbitrary code execution.

Why it matters to the business

Processing untrusted waveform files on developer or test systems can result in full host compromise, loss of intellectual property, and disruption of hardware-design workflows.

How an attack unfolds

An attacker creates a malformed .vcd file that triggers the realloc path inside get_vartoken; the victim runs the file through the vcd2lxt conversion utility, the dangling pointer is reused, and attacker-controlled code executes with the privileges of the converting process. Public exploit code is available.

How to fix it

Upgrade GTKWave to the latest release that resolves the realloc handling defect; if no patched version is yet published, replace or sandbox the vcd2lxt binary and avoid converting untrusted .vcd files.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115, run the vendor test suite against known-good and known-bad .vcd samples, and verify that vcd2lxt no longer crashes or produces heap corruption on the crafted input.

Typical attack path

1. Attacker crafts a .vcd file that exercises the realloc path in get_vartoken
2. Malicious file is delivered via email, download, or shared repository
3. Victim invokes vcd2lxt on the file
4. Use-after-free is triggered, enabling arbitrary code execution

How to detect it

Review process execution logs and file-access records for vcd2lxt invocations on externally sourced .vcd files; inspect system logs for unexpected crashes or segfaults of the conversion utility and look for subsequent suspicious child processes or network connections.

What your security team should do

• Immediately restrict vcd2lxt execution to trusted files only
• Apply the newest GTKWave package as soon as it becomes available
• Add vcd2lxt to application allow-listing or containerize its use
• Monitor for new fixed-version announcements from the GTKWave project