CVE-2023-37578 Use after free in GTKWave

High 7.8 Published 8 Jan 2024 Updated 4 Nov 2025

A use-after-free in GTKWave's vcd2lxt utility allows arbitrary code execution when a victim opens a malicious VCD file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-37578?

CVE-2023-37578 is a high-severity use after free vulnerability in Tonybybell Gtkwave, published on 8 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt conversion utility.

Weakness: CWE-416

Which versions are affected by CVE-2023-37578?

It affects 1 product.

Products include Tonybybell Gtkwave.

How do I fix CVE-2023-37578?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-37578 being exploited?

There is no known exploitation of CVE-2023-37578 in the wild and no public exploit code.

All Tonybybell Gtkwave vulnerabilities

Sources

Also known as DEBIAN-CVE-2023-37578, GHSA-6m28-3r86-ccr3, UBUNTU-CVE-2023-37578.