CVE-2023-37922: 
NixOS vulnerability analysis and mitigation

Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. The vulnerability (CVE-2023-37922) specifically concerns the arbitrary write when triggered via the vcd2lxt2 conversion utility. A specially crafted .vcd file can lead to arbitrary code execution, where a victim would need to open a malicious file to trigger these vulnerabilities (Talos).

The vulnerability has a CVSS v3.1 Base Score of 7.8 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue occurs in the vcd2lxt2 conversion utility where the code does not check if the sorted buffer is initialized before calling bsearch, leading to an arbitrary read which could be turned into an arbitrary write (NVD, Talos).

If successfully exploited, this vulnerability could lead to arbitrary code execution on the targeted system. The vulnerability affects the integrity and confidentiality of the system, with potential for high impact on all three security metrics - confidentiality, integrity, and availability (Talos).

The vulnerability has been fixed in GTKWave version 3.3.118. Users are advised to upgrade to this version or later to mitigate the vulnerability (Debian).