Arbitrary Code Execution Vulnerability in vsimk.exe

CVE-2024-47196

Summary

A vulnerability exists in ModelSim and Questa where the vsimk.exe executable allows an attacker to load a specific tcl file from the current working directory. This scenario presents a risk for installations where the application is launched from a user-writable directory by administrators or processes with elevated privileges. As a result, authenticated local attackers can potentially inject arbitrary code, leading to privilege escalation and unauthorized actions within the system.

References