CVE-2023-37923

What it actually does

The vulnerability allows an arbitrary memory write during sorted bsearch operations on a crafted VCD file processed by the vcd2lxt utility, resulting in arbitrary code execution on the local system.

Why it matters to the business

Attackers can gain full control of systems used to convert or view simulation waveform files, leading to potential data theft, malware deployment, or disruption of hardware design and verification workflows.

How an attack unfolds

An attacker crafts a malicious VCD file that triggers the sorted bsearch flaw inside vcd2lxt. The file is delivered to a victim who opens it with the conversion utility, causing memory corruption that executes attacker-supplied code. Public exploits are available and the issue has been known for over two years.

How to fix it

Disable or restrict use of the vcd2lxt utility on untrusted files. Monitor vendor releases for a patched version of GTKWave and apply it as soon as it becomes available. Consider sandboxing or replacing the tool with a safer alternative for waveform conversion.

How to confirm the fix worked

Verify the installed GTKWave version against the latest available release. Test vcd2lxt behavior with known-good and known-malicious sample files in an isolated environment to confirm the write primitive is no longer reachable.

Typical attack path

1. Create a specially formatted VCD file that triggers the bsearch write primitive
2. Deliver the file via email, download link, or shared repository
3. Victim executes vcd2lxt on the malicious file
4. Memory corruption occurs and attacker payload executes

How to detect it

Review process execution logs for vcd2lxt invocations on files from external or untrusted sources. Monitor for unexpected crashes or child processes spawned by vcd2lxt. Examine file-access and command-line history for .vcd files processed shortly before anomalous activity.

• vcd2lxt
• .vcd
• vcd2lxt.exe

What your security team should do

• Immediately restrict execution of vcd2lxt to trusted files only
• Add vcd2lxt to application allow-listing or endpoint controls
• Scan internal repositories and build pipelines for usage of the utility
• Subscribe to GTKWave release notifications for patch availability