Arbitrary code execution via post-header variable definitions

Out-of-bounds memory access in GTKWave 3.3.115 allows attackers to execute arbitrary code through a crafted VCD file processed by vcd2lxt2. The converter accepts variable definitions after the end-of-definitions marker, changes hash bounds after allocating the symbol index, and later uses the altered bounds for an out-of-range lookup and attacker-controlled write. Exploitation requires a local user to invoke the conversion utility on the malicious file and grants code execution in that user's context.