CVE-2023-37922

What it actually does

Arbitrary write vulnerability in VCD sorted bsearch functionality allows code execution when processing a malicious file via the vcd2lxt2 utility.

Why it matters to the business

Attackers can gain full control of systems that process untrusted VCD waveform files, leading to potential data theft, system compromise, or further network intrusion; low EPSS and no known ransomware use reduce immediate urgency but the flaw remains exploitable locally.

How an attack unfolds

An attacker crafts a malicious .vcd file that triggers the sorted bsearch arbitrary write during conversion; the victim must open or convert the file using the vulnerable vcd2lxt2 utility, resulting in arbitrary code execution.

How to fix it

Upgrade affected GTKWave installations to a version containing the fix commit c52b023659f4ad7b626874c1063f2b5e878a4fe0; avoid processing untrusted .vcd files until updated.

How to confirm the fix worked

Verify the installed GTKWave version is newer than 3.3.115 and contains commit c52b023659f4ad7b626874c1063f2b5e878a4fe0; test by attempting conversion of known-good VCD files.

Typical attack path

1. Craft malicious .vcd file exploiting VCD bsearch logic
2. Deliver file to victim via email, download, or shared storage
3. Victim opens file with vcd2lxt2 conversion utility
4. Arbitrary write occurs leading to code execution

How to detect it

Review process execution logs and file access records for invocations of vcd2lxt2 on unexpected .vcd files; look for unusual child processes or crashes following VCD conversion attempts.

What your security team should do

• Prioritize patching GTKWave on developer and engineering workstations that handle waveform files
• Implement file-type restrictions or sandboxing for VCD processing utilities
• Monitor for new exploit releases given the ExploitAvailable maturity rating