{"id":37010,"date":"2025-05-10T19:05:58","date_gmt":"2025-05-10T19:05:58","guid":{"rendered":""},"modified":"2025-09-03T04:05:58","modified_gmt":"2025-09-03T10:05:58","slug":"cve-2023-37578-use-after-free-vulnerabilities-in-gtkwave-3-3-115-leading-to-arbitrary-code-execution","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-37578-use-after-free-vulnerabilities-in-gtkwave-3-3-115-leading-to-arbitrary-code-execution\/","title":{"rendered":"CVE-2023-37578: Use-After-Free Vulnerabilities in GTKWave 3.3.115 Leading to Arbitrary Code Execution<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

We are delving into the details of a serious vulnerability identified as CVE-2023-37578. This vulnerability is present in the popular waveform viewer and simulator, GTKWave, specifically version 3.3.115. This vulnerability arises from multiple use-after-free conditions<\/a> within the VCD get_vartoken realloc functionality. Its severity is underscored by the potential for arbitrary code execution<\/a>, which could lead to system compromise and data leakage. Victims are at risk if they open a specially crafted, malicious .vcd file. As such, users of GTKWave, especially those dealing with untrusted .vcd files, should be aware of and take immediate steps to mitigate this risk<\/a>.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2023-37578
\nSeverity: High (CVSS: 7.8)
\nAttack Vector: Local
\nPrivileges Required: User
\nUser Interaction: Required
\nImpact: Arbitrary code<\/a> execution, potential system compromise, and data leakage.<\/p>\n

Affected Products<\/strong><\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n A new way to communicate\r\n <\/h2>\r\n\r\n

\r\n Ameeba Chat is built on encrypted identity, not personal profiles.\r\n <\/p>\r\n\r\n

\r\n Message, call, share files, and coordinate with identities kept separate.\r\n <\/p>\r\n\r\n