CVE-2023-37576 Use after free in GTKWave

High 7.8 Published 8 Jan 2024 Updated 4 Nov 2025

A use-after-free in GTKWave allows arbitrary code execution when a victim opens a malicious VCD file using the vcd2vzt utility.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-37576?

CVE-2023-37576 is a high-severity use after free vulnerability in Tonybybell Gtkwave, published on 8 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2vzt conversion utility.

Weakness: CWE-416

Which versions are affected by CVE-2023-37576?

It affects 1 product.

Products include Tonybybell Gtkwave.

How do I fix CVE-2023-37576?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-37576 being exploited?

There is no known exploitation of CVE-2023-37576 in the wild and no public exploit code.

All Tonybybell Gtkwave vulnerabilities

Sources

Also known as DEBIAN-CVE-2023-37576, GHSA-xxcm-q624-6hcv, UBUNTU-CVE-2023-37576.