CVE-2024-47196

Name of the Vulnerable Software and Affected Versions ModelSim versions prior to V2024.3 Questa versions prior to V2024.3

Description A vulnerability has been identified that allows an authenticated local attacker to inject arbitrary code and escalate privileges. This occurs when vsimk.exe in affected applications loads a specific tcl file from the current working directory, potentially allowing privilege escalation in installations where administrators or processes with elevated privileges launch vsimk.exe from a user-writable directory.

Recommendations For ModelSim versions prior to V2024.3, update to version V2024.3 or later to resolve the issue. For Questa versions prior to V2024.3, update to version V2024.3 or later to resolve the issue. As a temporary workaround, consider restricting the launch of vsimk.exe from user-writable directories to minimize the risk of exploitation.