CVE-2023-36746: High Memory Flaw in GTKWave FST Files

CVE-2023-36746 is a high severity memory corruption flaw (CVSS 7.0) in GTKWave 3.3.115, a waveform viewer. A crafted .fst file can corrupt memory when opened. Talos reports it fixed in GTKWave 3.3.118, so upgrade and open wave files only from sources you trust.

What's affected

• Product: GTKWave, the open source waveform viewer used with digital design simulations.
• Affected version: 3.3.115, the version the record and Cisco Talos name as confirmed vulnerable.
• Fixed version: 3.3.118, released by the vendor on 2023-12-31 according to Talos. The Talos report TALOS-2023-1793 was published on 2024-01-08.
• Debian: the Debian LTS announcement for buster lists gtkwave 3.3.98+really3.3.118-0+deb10u1 as the fixed package, and includes CVE-2023-36746 among the CVEs it covers.
• Severity: High, CVSS 7.0. The vector marks local access with user interaction required, so the victim has to open a file.
• Exploited in the wild: the record's CISA KEV flag is false.

The flaw is an heap-based buffer overflow in the handling of a length value in the fstWritex function while parsing the time table of an FST file. Talos describes the file as the way in: a person has to open a specially crafted .fst file, and because GTKWave registers MIME types for its formats, opening one from an email can be as simple as a double-click.

How to check if you're exposed

Check the installed version of GTKWave on every machine that has it:

gtkwave --version
dpkg -l gtkwave
brew list --versions gtkwave

Use the command that matches your system. Any 3.3.115 install is in scope. On Debian based systems, compare the package version with the fixed Debian version above, and check your distribution's security tracker for releases other than buster.

If you track software with an SBOM, search it for gtkwave. Engineering workstations and shared lab servers are easy to miss.

What to do now

1. List where GTKWave is installed, including CI images and shared simulation hosts.
2. Upgrade to 3.3.118 or later, or install your distribution's patched package.
3. Until you upgrade, do not open .fst files from people or sources you do not trust, and be wary of wave files sent by email.
4. If your build pipeline accepts waveform files from outside, keep GTKWave tools out of automated paths that handle untrusted input.
5. Re-scan your images and hosts afterwards to confirm the old version is gone.

Note that this advisory covers two CVEs for related heap overflows in the same area of code, so a single upgrade closes both.

Why it matters

The weakness classes are CWE-119 and CWE-787. These are memory safety errors: a program writes past the end of a buffer it allocated, or computes a size that overflows and then allocates too little. The result is memory corruption that, according to Talos, can lead to arbitrary code execution under the privileges of the user.

File parsers for niche formats get less scrutiny than mainstream ones, yet engineers open files from vendors, colleagues and public repositories all day. A local attack with user interaction is lower risk than a remote one, which is why the score sits at 7.0, but a shared design file is exactly the kind of thing people open without a second thought.

Safeguard can help with the inventory side of this work. The free in-browser dependency scan at gold.safeguard.sh/scan checks the packages in a manifest against known CVEs, and the Gold directory keeps a page per CVE and per weakness class so you can see related issues in one place. Reachability analysis then helps you separate a package that is merely present from one your code actually calls.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NVD record for CVE-2023-36746
• Safeguard Gold page
• Cisco Talos report TALOS-2023-1793
• Debian LTS announcement

Last reviewed: 19 October 2026.