CVE-2023-37921

What it actually does

Arbitrary write in VCD sorted bsearch functionality of GTKWave 3.3.115 via vcd2vzt conversion utility allows memory corruption leading to arbitrary code execution when a malicious .vcd file is processed.

Why it matters to the business

Attackers can achieve code execution on user systems that open crafted waveform files, risking data theft or system compromise; low exploit probability but available public exploit increases urgency for affected installations despite over 1000 days since disclosure.

How an attack unfolds

An attacker creates a malicious .vcd file that triggers the arbitrary write condition in the sorted bsearch code path during vcd2vzt processing; the victim opens the file with the conversion utility, resulting in memory corruption and attacker-controlled code execution.

How to fix it

Upgrade affected woocommerce/woocommerce (GIT) installations to the fixed commit 0e9888305d0cb9557e58f558526ab11cb3bcc4b4; avoid processing untrusted .vcd files until patched.

How to confirm the fix worked

Confirm software version or commit hash matches 0e9888305d0cb9557e58f558526ab11cb3bcc4b4; test with known-good and crafted .vcd samples to verify the bsearch path no longer permits writes.

Typical attack path

1. Craft malicious .vcd file exploiting sorted bsearch arbitrary write
2. Distribute file to target via email or download
3. Victim invokes vcd2vzt on the file
4. Arbitrary write leads to code execution

How to detect it

Review process execution logs and file access records for vcd2vzt invocations on unexpected .vcd files; correlate with memory corruption indicators or post-exploitation artifacts.

What your security team should do

• Apply the listed commit fix immediately across all instances
• Restrict opening of external .vcd files to trusted sources only
• Monitor EPSS trend and exploit availability for any change in risk