CVE-2023-37574: High Use-After-Free in GTKWave 3.3.115 (legacy parser)

CVE-2023-37574 is a high severity (CVSS 7.8) use-after-free in GTKWave 3.3.115, reached through the GUI legacy VCD parser. A crafted VCD file can lead to code execution when a user opens it. Debian LTS shipped fixed packages based on GTKWave 3.3.118, so update or check the advisory for your distribution.

What's affected

The NVD record lists GTKWave 3.3.115 as the affected version. The Talos report is TALOS-2023-1806, and this CVE covers a use-after-free in the get_vartoken realloc handling in the VCD parser, specifically when it is triggered via the GUI legacy VCD parser. It is one of two CVEs from Talos report TALOS-2023-1806 (CVE-2023-37573 and CVE-2023-37574), one for each GUI parser the bug can be reached through. The weakness is recorded as CWE-416 (use after free).

The Debian LTS advisory DLA-3785-1 of 9 April 2024 lists this CVE among many GTKWave fixes and gives the fixed package for Debian 10 as 3.3.98+really3.3.118-0+deb10u1. The "really3.3.118" in that string tells you the package carries the upstream 3.3.118 code. I could not load the Talos report, so I cannot confirm the upstream first fixed version from it. Check the Talos report and the GTKWave release notes before you rely on a specific upstream number.

How to check if you're exposed

1. Run gtkwave --version to see the installed version. 3.3.115 is the version named in the record.
2. On Debian based systems, run dpkg -l gtkwave and compare the package version with the fixed versions in the Debian security notices.
3. On other systems, ask your package manager for the installed gtkwave version and read your distribution security tracker for this CVE.
4. Check whether the conversion tools are installed and used in scripts, since the GUI legacy VCD parser is one of the routes into the bug. GTKWave packages normally ship tools such as vcd2vzt, vcd2lxt and vcd2lxt2 alongside the viewer.
5. Look at where VCD files come from in your workflow. Files from simulators you run are one thing. Files received from outside are another.

What to do now

1. Update GTKWave to a patched build from your distribution. On Debian 10 that is the DLA-3785-1 package, and other Debian releases have their own security updates.
2. Do not open VCD files from untrusted sources until you have updated, in the viewer or in the conversion tools.
3. If you build GTKWave from source, move to a release newer than 3.3.115 and check the upstream notes for the fix.
4. Include hardware design workstations and build servers in your patching, since these are easy to leave off an inventory.
5. Re-check the version after the update to be sure the old binary is not still on the path.

Why it matters

GTKWave reads waveform dumps produced by hardware simulators. The VCD parser has to trust the structure of a file that can be large and unusual. In this case the code mishandles memory it has already freed after a realloc, so it uses a stale pointer. The record says a crafted file can lead to arbitrary code execution, and that the victim must open the file.

Desktop engineering tools are not often the first thing in a patch plan, but they run on machines that hold design files and source. The record does not mark this CVE as known exploited, and the sources I read do not report exploitation. For tooling like this, reachability matters: a tool that is installed but never opens outside files is a lower priority than one that does. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest or lockfile, and browse the Gold directory for related entries.

Quick check

Sources

• Debian LTS advisory DLA-3785-1 for gtkwave

Last reviewed: 19 October 2026.