CVE-2023-35128 is an integer overflow in the FST reader of GTKWave 3.3.115, scored 7.0 High. A crafted .fst file can cause memory corruption when a user opens it. Debian ships a package built on GTKWave 3.3.118 that fixes it, so update the viewer.
What's affected
The record lists GTKWave 3.3.115 as affected. The flaw is in fstReaderIterBlocks2, where the tsec_nitems value for the time table is used in an allocation. Opening a crafted .fst file can lead to memory corruption.
Debian LTS lists this CVE among those fixed in package 3.3.98+really3.3.118-0+deb10u1 for Debian 10, which tracks upstream 3.3.118. The record gives Talos report TALOS-2023-1792 as a reference, which I did not read, so check it for upstream detail.
How to check if you're exposed
GTKWave is a waveform viewer. Check how it is installed. On Debian and Ubuntu, read the package version:
dpkg -l gtkwave
apt-cache policy gtkwave
On Debian 10, the fixed package version named in the Debian LTS announcement is 3.3.98+really3.3.118-0+deb10u1. If you built from source or use a download from the project, check the version shown in the About box. Upstream 3.3.115 is the version the record lists as affected, and the Talos report for CVE-2023-34436 says 3.3.118 fixes that issue.
Also think about where waveform files come from. Hardware teams exchange simulation dumps with partners, vendors and open source projects, and CI jobs may open them automatically.
What to do now
- Update GTKWave to a fixed build: version 3.3.118 upstream, or your distribution's patched package. On Debian 10 that is 3.3.98+really3.3.118-0+deb10u1.
- Until you have updated, do not open FST files from sources you do not trust.
- If your CI or review tooling opens waveform files automatically, run it in a sandbox without secrets.
- Ask partners to share waveforms through channels you can verify.
- Add GTKWave to your tool inventory so the next advisory is a lookup.
Why it matters
The score is 7.0 rather than 7.8 because the record rates attack complexity as high. The class is the same as the other GTKWave overflows: a size taken from a file is used in arithmetic that can wrap.
FST is the format GTKWave users meet most often, since several simulators write it. That makes this reader a likelier target than the rarer formats, and it is worth patching on that ground alone.
The weakness classes involved are CWE-190 (Integer Overflow or Wraparound). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
The record scores this CVE as shown in the title. I did not read the Talos report for this CVE, so I could not compare its score. The Debian announcement lists it as fixed in the 3.3.118 based package.
Try it yourself
You cannot patch a tool you do not know you have. This demo shows how an inventory of installed software and dependencies answers that question for advisories like this one.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be attacked over the network?
No. The record describes a local vector with user interaction: someone has to open a specially crafted file.
Which version fixes it?
The Debian LTS package is based on 3.3.118, and the Talos report for the related CVE-2023-34436 says 3.3.118 fixes it. Confirm your own build.
Sources
Last reviewed: 19 October 2026.
