CVE-2023-37922: gtkwave — Exploit

Description

Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt2 conversion utility.

Is your site exposed to CVE-2023-37922?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-118 CWE-118

Affected Products

Vendor	Product	Versions
tonybybell	gtkwave	All

References

Exploits

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1807 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1807

Other References

https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1807

Frequently Asked Questions

What is CVE-2023-37922? +

Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt2 conversion utility. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2023-37922? +

CVE-2023-37922 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2023-37922? +

CVE-2023-37922 affects products from tonybybell, specifically: gtkwave. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-37922? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-50367 7.8

Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

CVE-2023-37921 7.8

Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can …

CVE-2023-37923 7.8

Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can …

CVE-2024-43524 6.8

Windows Mobile Broadband Driver Remote Code Execution Vulnerability

CVE-2025-48902 6.6

Vulnerability of uncontrolled system resource applications in the setting module Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-54628 5.3

Vulnerability of incomplete verification information in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2023-37922