CVE-2023-37443

Summary

CVE-2023-37443 is a newly discovered vulnerability in GTKWave 3.3.115 that allows for arbitrary code execution. The issue stems from multiple out-of-bounds read vulnerabilities located in the VCD var definition section functionality. Malicious .vcd files can exploit this weakness, necessitating a victim to open the malicious file to trigger the vulnerability. The root cause is the legacy VCD parsing code in the GTKWave GUI.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.