Code execution via unchecked sorted-array binary search

Arbitrary write in GTKWave 3.3.115 allows attackers to execute code by inducing a user to process a crafted VCD file with vcd2lxt2. The vcd2lxt2 bsearch_vcd function calls bsearch with a null sorted-array pointer when an identifier hash falls outside the indexed range, allowing attacker-influenced memory to be treated as a vcdsymbol whose size and value fields drive writes. Exploitation requires user interaction with a malicious VCD file and can compromise confidentiality, integrity, and availability through code execution.