CVE-2023-34436 is an out-of-bounds write in the LXT2 file reader of GTKWave 3.3.115, scored 7.8 High. A crafted .lxt2 file can lead to code execution when a user opens it. Talos says GTKWave 3.3.118 fixes it, and Debian ships a patched package.
What's affected
The record lists GTKWave 3.3.115 as affected. The flaw is in the handling of num_time_table_entries when reading an LXT2 file. Opening a crafted .lxt2 file can lead to arbitrary code execution.
Per Cisco Talos report TALOS-2023-1819, version 3.3.115 is the version confirmed vulnerable and the vendor fixed the issue in 3.3.118, released on 31 December 2023. Debian LTS lists this CVE among those fixed in package 3.3.98+really3.3.118-0+deb10u1 for Debian 10.
How to check if you're exposed
GTKWave is a waveform viewer. Check how it is installed. On Debian and Ubuntu, read the package version:
dpkg -l gtkwave
apt-cache policy gtkwave
On Debian 10, the fixed package version named in the Debian LTS announcement is 3.3.98+really3.3.118-0+deb10u1. If you built from source or use a download from the project, check the version shown in the About box. Upstream 3.3.115 is the version the record lists as affected, and the Talos report for CVE-2023-34436 says 3.3.118 fixes that issue.
Also think about where waveform files come from. Hardware teams exchange simulation dumps with partners, vendors and open source projects, and CI jobs may open them automatically.
What to do now
- Update GTKWave to a fixed build: version 3.3.118 upstream, or your distribution's patched package. On Debian 10 that is 3.3.98+really3.3.118-0+deb10u1.
- Until you have updated, do not open LXT2 files from sources you do not trust.
- If your CI or review tooling opens waveform files automatically, run it in a sandbox without secrets.
- Ask partners to share waveforms through channels you can verify.
- Add GTKWave to your tool inventory so the next advisory is a lookup.
Why it matters
An out-of-bounds write means the program stores data beyond the end of a buffer. Here the bad length comes from a field in the file, and the reader trusts it.
Waveform viewers are an easy item to overlook. They run on engineers' machines, open files that come from other people and rarely appear in vulnerability programs. Treat them like any other parser of untrusted data.
The weakness classes involved are CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-787 (Out-of-bounds Write). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Talos and the record agree on 7.8 High. Talos names 3.3.118 as the fixed version, and Debian's package is based on it.
Try it yourself
A tool like GTKWave may be installed on a build host without being called by anything that handles outside files. This demo shows how reachability analysis separates those cases from the ones that matter.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be attacked over the network?
No. The record describes a local vector with user interaction: someone has to open a specially crafted file.
Which version fixes it?
The Debian LTS package is based on 3.3.118, and the Talos report for the related CVE-2023-34436 says 3.3.118 fixes it. Confirm your own build.
Sources
Last reviewed: 19 October 2026.
