CVE-2023-37447: High Out-of-Bounds Read in GTKWave 3.3.115 (vcd2lxt)

CVE-2023-37447 is a high severity (CVSS 7.8) out-of-bounds read in GTKWave 3.3.115, reached through the vcd2lxt conversion utility. A crafted VCD file can lead to code execution when a user opens it. Debian LTS shipped fixed packages based on GTKWave 3.3.118, so update or check the advisory for your distribution.

What's affected

The NVD record lists GTKWave 3.3.115 as the affected version. The Talos report is TALOS-2023-1805, and this CVE covers an out-of-bounds read in the parsing of the var definition section of a VCD file, specifically when it is triggered via the vcd2lxt conversion utility. It is one of six CVEs from Talos report TALOS-2023-1805 (CVE-2023-37442 to CVE-2023-37447), one for each parser or conversion tool the bug can be reached through. The weakness is recorded as CWE-119 (improper restriction of operations within the bounds of a memory buffer). The wording of the NVD description for the conversion tools says out-of-bounds write although the issue family is described as out-of-bounds read, so use the Talos report as the reference for the exact behaviour.

The Debian LTS advisory DLA-3785-1 of 9 April 2024 lists this CVE among many GTKWave fixes and gives the fixed package for Debian 10 as 3.3.98+really3.3.118-0+deb10u1. The "really3.3.118" in that string tells you the package carries the upstream 3.3.118 code. I could not load the Talos report, so I cannot confirm the upstream first fixed version from it. Check the Talos report and the GTKWave release notes before you rely on a specific upstream number.

How to check if you're exposed

1. Run gtkwave --version to see the installed version. 3.3.115 is the version named in the record.
2. On Debian based systems, run dpkg -l gtkwave and compare the package version with the fixed versions in the Debian security notices.
3. On other systems, ask your package manager for the installed gtkwave version and read your distribution security tracker for this CVE.
4. Check whether the conversion tools are installed and used in scripts, since the vcd2lxt conversion utility is one of the routes into the bug. GTKWave packages normally ship tools such as vcd2vzt, vcd2lxt and vcd2lxt2 alongside the viewer.
5. Look at where VCD files come from in your workflow. Files from simulators you run are one thing. Files received from outside are another.

What to do now

1. Update GTKWave to a patched build from your distribution. On Debian 10 that is the DLA-3785-1 package, and other Debian releases have their own security updates.
2. Do not open VCD files from untrusted sources until you have updated, in the viewer or in the conversion tools.
3. If you build GTKWave from source, move to a release newer than 3.3.115 and check the upstream notes for the fix.
4. Include hardware design workstations and build servers in your patching, since these are easy to leave off an inventory.
5. Re-check the version after the update to be sure the old binary is not still on the path.

Why it matters

GTKWave reads waveform dumps produced by hardware simulators. The VCD parser has to trust the structure of a file that can be large and unusual. In this case the code mishandles an index or length when it reads definitions, so it reads outside the buffer it was given. The record says a crafted file can lead to arbitrary code execution, and that the victim must open the file.

Desktop engineering tools are not often the first thing in a patch plan, but they run on machines that hold design files and source. The record does not mark this CVE as known exploited, and the sources I read do not report exploitation. For tooling like this, reachability matters: a tool that is installed but never opens outside files is a lower priority than one that does. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest or lockfile, and browse the Gold directory for related entries.

Quick check

Sources

• Debian LTS advisory DLA-3785-1 for gtkwave

Last reviewed: 19 October 2026.