CVE-2023-36915 is a high severity memory corruption flaw (CVSS 7.8) in GTKWave 3.3.115, a waveform viewer. A crafted .fst file can corrupt memory when opened. Talos reports it fixed in GTKWave 3.3.118, so upgrade and open wave files only from sources you trust.
What's affected
- Product: GTKWave, the open source waveform viewer used with digital design simulations.
- Affected version: 3.3.115, the version the record and Cisco Talos name as confirmed vulnerable.
- Fixed version: 3.3.118, released by the vendor on 2023-12-31 according to Talos. The Talos report TALOS-2023-1798 was published on 2024-01-08.
- Debian: the Debian LTS announcement for buster lists gtkwave 3.3.98+really3.3.118-0+deb10u1 as the fixed package, and includes CVE-2023-36915 among the CVEs it covers.
- Severity: High, CVSS 7.8. The vector marks local access with user interaction required, so the victim has to open a file.
- Exploited in the wild: the record's CISA KEV flag is false.
The flaw is an integer overflow in the allocation of the chain_table array in fstReaderIterBlocks2, which can lead to heap out-of-bounds writes. Talos describes the file as the way in: a person has to open a specially crafted .fst file, and because GTKWave registers MIME types for its formats, opening one from an email can be as simple as a double-click.
How to check if you're exposed
Check the installed version of GTKWave on every machine that has it:
gtkwave --version
dpkg -l gtkwave
brew list --versions gtkwave
Use the command that matches your system. Any 3.3.115 install is in scope. On Debian based systems, compare the package version with the fixed Debian version above, and check your distribution's security tracker for releases other than buster.
If you track software with an SBOM, search it for gtkwave. Engineering workstations and shared lab servers are easy to miss.
What to do now
- List where GTKWave is installed, including CI images and shared simulation hosts.
- Upgrade to 3.3.118 or later, or install your distribution's patched package.
- Until you upgrade, do not open .fst files from people or sources you do not trust, and be wary of wave files sent by email.
- If your build pipeline accepts waveform files from outside, keep GTKWave tools out of automated paths that handle untrusted input.
- Re-scan your images and hosts afterwards to confirm the old version is gone.
Why it matters
The weakness classes are CWE-190. These are memory safety errors: a program writes past the end of a buffer it allocated, or computes a size that overflows and then allocates too little. The result is memory corruption that, according to Talos, can lead to arbitrary code execution under the privileges of the user.
File parsers for niche formats get less scrutiny than mainstream ones, yet engineers open files from vendors, colleagues and public repositories all day. A local attack with user interaction is lower risk than a remote one, which is why the score sits at 7.8, but a shared design file is exactly the kind of thing people open without a second thought.
Safeguard can help with the inventory side of this work. The free in-browser dependency scan at gold.safeguard.sh/scan checks the packages in a manifest against known CVEs, and the Gold directory keeps a page per CVE and per weakness class so you can see related issues in one place. Reachability analysis then helps you separate a package that is merely present from one your code actually calls.
Quick check
Does this need network access?
No. The vector is local and needs user interaction. Someone has to open the crafted .fst file in GTKWave.
Which version fixes it?
GTKWave 3.3.118 per Cisco Talos. Debian buster users should look for gtkwave 3.3.98+really3.3.118-0+deb10u1 or newer.
Sources
- NVD record for CVE-2023-36915
- Safeguard Gold page
- Cisco Talos report TALOS-2023-1798
- Debian LTS announcement
Last reviewed: 19 October 2026.
