CVE-2023-35004 is an integer overflow in the VZT file reader of GTKWave 3.3.115, scored 7.8 High. A crafted .vzt file can lead to code execution when a user opens it. Debian ships a package built on GTKWave 3.3.118 that fixes it.
What's affected
The record lists GTKWave 3.3.115 as affected. The flaw is in the allocation based on the longest_len value when reading a VZT file. Opening a crafted .vzt file can lead to arbitrary code execution.
Debian LTS lists this CVE among those fixed in package 3.3.98+really3.3.118-0+deb10u1 for Debian 10, which tracks upstream 3.3.118. The record gives Talos report TALOS-2023-1816 as a reference, which I did not read, so check it for upstream detail.
How to check if you're exposed
GTKWave is a waveform viewer. Check how it is installed. On Debian and Ubuntu, read the package version:
dpkg -l gtkwave
apt-cache policy gtkwave
On Debian 10, the fixed package version named in the Debian LTS announcement is 3.3.98+really3.3.118-0+deb10u1. If you built from source or use a download from the project, check the version shown in the About box. Upstream 3.3.115 is the version the record lists as affected, and the Talos report for CVE-2023-34436 says 3.3.118 fixes that issue.
Also think about where waveform files come from. Hardware teams exchange simulation dumps with partners, vendors and open source projects, and CI jobs may open them automatically.
What to do now
- Update GTKWave to a fixed build: version 3.3.118 upstream, or your distribution's patched package. On Debian 10 that is 3.3.98+really3.3.118-0+deb10u1.
- Until you have updated, do not open VZT files from sources you do not trust.
- If your CI or review tooling opens waveform files automatically, run it in a sandbox without secrets.
- Ask partners to share waveforms through channels you can verify.
- Add GTKWave to your tool inventory so the next advisory is a lookup.
Why it matters
An integer overflow happens when arithmetic on a size wraps around to a small number. The program then allocates too little memory and later writes more than fits. Reading a size from a file and multiplying it without a check is the classic setup.
The fix is range checking before the allocation. For you, the fix is the updated package, since the project's other readers had similar issues reported at the same time.
The weakness classes involved are CWE-190 (Integer Overflow or Wraparound). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
The record scores this CVE as shown in the title. I did not read the Talos report for this CVE, so I could not compare its score. The Debian announcement lists it as fixed in the 3.3.118 based package.
Quick check
Do I need to be attacked over the network?
No. The record describes a local vector with user interaction: someone has to open a specially crafted file.
Which version fixes it?
The Debian LTS package is based on 3.3.118, and the Talos report for the related CVE-2023-34436 says 3.3.118 fixes it. Confirm your own build.
Sources
Last reviewed: 19 October 2026.
