CVE-2023-35955 is a high severity (7.8) heap overflow in GTKWave 3.3.115, triggered by opening a crafted FST waveform file. This entry concerns the LZ4 decompression call. Debian's fixed packages are built from upstream 3.3.118, so update to that or your distribution's patched build.
What's affected
The record lists GTKWave 3.3.115, from Tony Bybell, as the affected version. It names no other release and gives no fixed version.
The Debian security tracker fills in the fix side. Its fixed packages are built from upstream 3.3.118:
- Debian 10 (buster): 3.3.98+really3.3.118-0+deb10u1, in advisory DLA-3785-1.
- Debian 11 (bullseye): 3.3.104+really3.3.118-0+deb11u1, in advisory DSA-5653-1.
- Debian 12 (bookworm): 3.3.118-0.1~deb12u1, in advisory DSA-5653-1.
- Debian testing and unstable carry 3.3.121 and 3.3.127.
So the record and the distribution disagree in how they describe the range. The record says 3.3.115. The fixed builds are 3.3.118. Releases between the two are not covered by either source. Treat 3.3.118 as the version to reach, and confirm against the Talos report, which I could not open because it blocked my request. Other distributions may use their own version strings, so read your vendor's advisory.
This CVE is one of four heap overflow reports that Cisco Talos filed under one report, TALOS-2023-1785. This one concerns the decompression function LZ4_decompress_safe_partial. The others in the group cover other decompression and copy functions in the same parsing path, so a single update fixes them together.
How to check if you're exposed
GTKWave is a desktop waveform viewer, so it usually sits on engineering workstations, lab machines and verification servers rather than production hosts. It also gets pulled into container images and build environments.
gtkwave --version
dpkg -s gtkwave | grep Version
brew list --versions gtkwave
Use the line that matches your system. On Debian or Ubuntu, compare the package version with the fixed builds listed above, and remember that distributions can backport fixes under older numbers, so read the package changelog for the CVE id if the number looks low.
Also look for shared directories where waveform files arrive, such as simulation output folders and vendor drops. The risk comes from opening a file, so knowing where untrusted files come from matters as much as the version number.
What to do now
- Find every machine, image and shared tool that has GTKWave installed, and record the version.
- Update to upstream 3.3.118 or later, or to your distribution's fixed package. On Debian, that means the update from DLA-3785-1 or DSA-5653-1.
- Until updated, do not open .fst files from sources you do not trust, and do not open them on a machine that holds credentials or source code.
- Treat waveform files that arrive from vendors, contractors or the internet as untrusted input, and open them on a disposable machine where you can.
- Re-check the version after the update, including inside container images that were built earlier.
Why it matters
The weakness is CWE-119, improper restriction of operations within the bounds of a memory buffer, in the heap memory area. The record says the problem sits in the VCDATA parsing of the FST reader, in the function fstReaderIterBlocks2. The text for this CVE says it concerns LZ4_decompress_safe_partial.
A heap overflow means a program writes past the end of a block of memory it allocated. The result can be a crash, or, with a carefully built file, control of the program. The record scores it 7.8 with a local vector, no privileges and one required user action, which is opening the file. It is not on CISA's Known Exploited Vulnerabilities list, and I found no claim of exploitation.
File format parsers are a steady source of this class of bug. Tools that open files from outside parties inherit the risk of every format they support, so treat what you open as untrusted input.
Try it yourself
Tools like this hide in build images and lab machines. This demo shows how a dependency inventory helps you find where a package is installed.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to open a file to be affected?
Yes. The record says a victim would need to open a malicious file.
Does updating fix the sibling CVEs?
The related reports sit in the same parsing code and Debian lists one fixed build for all of them. Read your distributor's advisory to confirm.
Sources
- Debian Security Tracker entry for CVE-2023-35955
- Talos report TALOS-2023-1785 (cited by the record; blocked to automated fetch)
- Debian LTS announcement cited by the record (needs JavaScript; not read)
- Safeguard Gold entry for CVE-2023-35955
Last reviewed: 19 October 2026.
