CVE-2023-37447

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt conversion utility.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-374483.3A lock screen issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14. A user may be able to view restric CVE-2023-37455.5A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local at CVE-2023-374508.8The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5,CVE-2023-374534.6An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in d CVE-2023-374545.5An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf CVE-2023-374555.4The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability CVE-2023-374566.5The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS <CVE-2023-374578.2Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0 CVE-2023-374595.3Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG netwo CVE-2023-37465.4The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and ab CVE-2023-374609.8Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArch CVE-2023-374619.8Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../