CVE-2023-37573

Summary

CVE-2023-37573 is a use-after-free vulnerability affecting GTKWave 3.3.115's VCD get_vartoken realloc functionality. Maliciously crafted .vcd files can exploit this weakness, leading to arbitrary code execution. The vulnerability arises when the software fails to properly manage memory during VCD parsing in the GUI's recorder module. A victim must open a malicious file to trigger the vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.