CVE-2023-37575: 
NixOS vulnerability analysis and mitigation

Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. The vulnerability specifically affects the GUI's interactive VCD parsing code when triggered via the interface. A specially crafted .vcd file can lead to arbitrary code execution, requiring a victim to open a malicious file to trigger these vulnerabilities (Talos).

The vulnerability is identified as a use-after-free issue (CWE-416) in the VCD get_vartoken realloc functionality. It has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue occurs when parsing VCD files through the GUI's interactive VCD parsing code, specifically at line vcd_partial.c:528 (NVD, Talos).

If successfully exploited, this vulnerability can lead to arbitrary code execution on the affected system. The impact is rated as high for confidentiality, integrity, and availability, though it requires user interaction to trigger the vulnerability (Talos).

The vulnerability has been fixed in GTKWave version 3.3.118. Users are recommended to upgrade to this version or later to mitigate the risk. The fix has been included in various distribution updates, including Debian 10 (buster) version 3.3.98+really3.3.118-0+deb10u1 (Debian LTS).