CVE-2023-35963 is a high severity (7.8) OS command injection in GTKWave 3.3.115, triggered by opening a crafted wave file. The weakness is in the vcd2lxt2 utility. Debian's fixed packages are built from upstream 3.3.118, so update to that or your distribution's patched build.
What's affected
The record lists GTKWave 3.3.115, from Tony Bybell, as the affected version. It names no other release and gives no fixed version.
The Debian security tracker fills in the fix side. Its fixed packages are built from upstream 3.3.118:
- Debian 10 (buster): 3.3.98+really3.3.118-0+deb10u1, in advisory DLA-3785-1.
- Debian 11 (bullseye): 3.3.104+really3.3.118-0+deb11u1, in advisory DSA-5653-1.
- Debian 12 (bookworm): 3.3.118-0.1~deb12u1, in advisory DSA-5653-1.
- Debian testing and unstable carry 3.3.121 and 3.3.127.
So the record and the distribution disagree in how they describe the range. The record says 3.3.115. The fixed builds are 3.3.118. Releases between the two are not covered by either source. Treat 3.3.118 as the version to reach, and confirm against the Talos report, which I could not open because it blocked my request. Other distributions may use their own version strings, so read your vendor's advisory.
Talos reported six OS command injection issues under TALOS-2023-1786, each in a different place that handles decompression. They share one update. This one concerns decompression in the vcd2lxt2 utility.
How to check if you're exposed
GTKWave is a desktop waveform viewer, so it usually sits on engineering workstations, lab machines and verification servers rather than production hosts. It also gets pulled into container images and build environments.
gtkwave --version
dpkg -s gtkwave | grep Version
brew list --versions gtkwave
Use the line that matches your system. On Debian or Ubuntu, compare the package version with the fixed builds listed above, and remember that distributions can backport fixes under older numbers, so read the package changelog for the CVE id if the number looks low.
Also look for shared directories where waveform files arrive, such as simulation output folders and vendor drops. The risk comes from opening a file, so knowing where untrusted files come from matters as much as the version number.
What to do now
- Find every machine, image and shared tool that has GTKWave installed, and record the version.
- Update to upstream 3.3.118 or later, or to your distribution's fixed package. On Debian, that means the update from DLA-3785-1 or DSA-5653-1.
- Until updated, do not open wave files from sources you do not trust, and do not open them on a machine that holds credentials or source code.
- Treat waveform files that arrive from vendors, contractors or the internet as untrusted input, and open them on a disposable machine where you can.
- If your workflow runs the converter utilities named in the advisory on files you receive, run them only on trusted files until you have updated.
- Re-check the version after the update, including inside container images that were built earlier.
Why it matters
The weakness is CWE-78, improper neutralization of special elements used in an OS command, commonly called OS command injection. The record says the decompression functionality of GTKWave 3.3.115 can be made to run arbitrary commands by a specially crafted wave file, and that a victim has to open the file. This entry concerns decompression in the vcd2lxt2 utility.
This class of bug usually appears when a program builds a command line for another tool from data it does not control, such as a file name, and does not neutralize special characters first. I am describing the class, not the exact code path, because the advisory text does not go further and I will not give attack detail.
The record scores it 7.8 with a local vector and one required user action. It is not on CISA's Known Exploited Vulnerabilities list, and I found no claim of exploitation. Command injection is often easier to use than a memory bug, since it does not depend on memory layout, which is a reason to patch it promptly.
Quick check
Does the attacker need to run anything on my machine?
The record says a victim would need to open a malicious file. The attacker supplies the file, and opening it is the trigger.
Is this a memory bug like the other GTKWave CVEs?
No. It is OS command injection, a different class, but it is reached the same way and is fixed in the same update.
Sources
- Debian Security Tracker entry for CVE-2023-35963
- Talos report TALOS-2023-1786 (cited by the record; blocked to automated fetch)
- Debian LTS announcement cited by the record (needs JavaScript; not read)
- Safeguard Gold entry for CVE-2023-35963
Last reviewed: 19 October 2026.
