CVE-2023-35704 is a high severity (CVSS 7.8) stack-based buffer overflow in fstReaderVarint32WithSkip, part of the FST reader in GTKWave 3.3.115. Opening a crafted .fst waveform file can lead to code execution. The vendor fixed it in version 3.3.118, and Debian 10 shipped a backport.
What's affected
The record lists GTKWave 3.3.115. Cisco Talos advisory TALOS-2023-1783 covers this CVE together with CVE-2023-35702, CVE-2023-35703 and CVE-2023-35704, one for each of three varint reading functions in the FST code. This post concerns fstReaderVarint32WithSkip. Talos and the record agree on the score of 7.8 and the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Talos reports that the vendor released a patch in version 3.3.118 on 2023-12-31, with public disclosure on 2024-01-08. The Debian LTS announcement for Debian 10 (buster) lists fixed package gtkwave 3.3.98+really3.3.118-0+deb10u1 for this CVE. The record's KEV flag is false.
How to check if you're exposed
GTKWave is a desktop viewer for simulation waveforms, so exposure follows wherever hardware engineers and verification teams work.
- Open the About dialog in GTKWave on each machine and compare the version with 3.3.118.
- On Debian or Ubuntu, run dpkg -s gtkwave and read the Version line, or apt policy gtkwave to see what is available.
- Check container images and CI runners that include simulation tools, since gtkwave is often installed there too.
- On macOS or Windows, check the version in the application's About dialog.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see a device firmware image, but it is useful for the software side of your estate.
What to do now
- Update GTKWave to 3.3.118 or later, or install your distribution's patched package. Debian 10 users should look for the LTS update named above.
- Do not open .fst files from sources you do not trust, including files received by email or downloaded from public repositories, until you are patched.
- Where possible, open untrusted waveform files in a disposable virtual machine or container.
- Add GTKWave to your software inventory so future advisories are matched against it.
Why it matters
The flaw is a CWE-121 and CWE-787 class bug. A stack buffer overflow happens when a program copies more data into a fixed-size stack buffer than it can hold. Here the length comes from a variable-length integer (LEB128) read out of the file, so a malformed file can drive the copy past the end of the buffer.
The attack needs a person to open the file, which is why the vector marks user interaction as required. Hardware teams routinely exchange waveform dumps with vendors and contractors, so a crafted file is a believable thing to receive.
Quick check
Do I need to open the file for CVE-2023-35704 to matter?
Yes. Talos describes the victim opening a malicious file, for example by double-clicking it.
What version fixes it?
GTKWave 3.3.118 per Talos. For Debian 10, the Debian LTS package version given above.
Sources
Last reviewed: 19 October 2026.
