CVE-2023-35057 is an integer overflow in the LXT2 reader of GTKWave 3.3.115, scored 7.8 High. A crafted .lxt2 file can cause memory corruption when a user opens it. Debian ships a package built on GTKWave 3.3.118 that fixes it, so update the viewer.
What's affected
The record lists GTKWave 3.3.115 as affected. The flaw is in the allocation of value elements in lxt2_rd_trace. Opening a crafted .lxt2 file can lead to memory corruption.
Debian LTS lists this CVE among those fixed in package 3.3.98+really3.3.118-0+deb10u1 for Debian 10, which tracks upstream 3.3.118. The record gives Talos report TALOS-2023-1821 as a reference, which I did not read, so check it for upstream detail.
How to check if you're exposed
GTKWave is a waveform viewer. Check how it is installed. On Debian and Ubuntu, read the package version:
dpkg -l gtkwave
apt-cache policy gtkwave
On Debian 10, the fixed package version named in the Debian LTS announcement is 3.3.98+really3.3.118-0+deb10u1. If you built from source or use a download from the project, check the version shown in the About box. Upstream 3.3.115 is the version the record lists as affected, and the Talos report for CVE-2023-34436 says 3.3.118 fixes that issue.
Also think about where waveform files come from. Hardware teams exchange simulation dumps with partners, vendors and open source projects, and CI jobs may open them automatically.
What to do now
- Update GTKWave to a fixed build: version 3.3.118 upstream, or your distribution's patched package. On Debian 10 that is 3.3.98+really3.3.118-0+deb10u1.
- Until you have updated, do not open LXT2 files from sources you do not trust.
- If your CI or review tooling opens waveform files automatically, run it in a sandbox without secrets.
- Ask partners to share waveforms through channels you can verify.
- Add GTKWave to your tool inventory so the next advisory is a lookup.
Why it matters
An integer overflow in a size calculation is a quiet bug: nothing fails at the point of the arithmetic, and the damage appears later when the program writes into an undersized buffer. Memory corruption can crash the program or, with effort, be steered toward code execution.
This is a separate bug from CVE-2023-34436, even though both live in the LXT2 reader. Fixing one does not prove the other is fixed, so compare package changelogs, not only version numbers.
The weakness classes involved are CWE-190 (Integer Overflow or Wraparound). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
The record scores this CVE as shown in the title. I did not read the Talos report for this CVE, so I could not compare its score. The Debian announcement lists it as fixed in the 3.3.118 based package.
Quick check
Do I need to be attacked over the network?
No. The record describes a local vector with user interaction: someone has to open a specially crafted file.
Which version fixes it?
The Debian LTS package is based on 3.3.118, and the Talos report for the related CVE-2023-34436 says 3.3.118 fixes it. Confirm your own build.
Sources
Last reviewed: 19 October 2026.
