CVE-2023-37575 is a high severity (CVSS 7.8) use-after-free flaw in GTKWave 3.3.115, the waveform viewer. A crafted VCD file can lead to code execution when someone opens it with the interactive VCD parser inside the GTKWave GUI. The record gives no fixed version, so check your distribution advisory and update the package.
What's affected
The NVD record names one product and version: GTKWave 3.3.115 from Tony Bybell (the project is also packaged by Linux distributions). The record scores the flaw 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms that is a local attack that needs no privileges but does need a user to open a file, with high impact on confidentiality, integrity and availability.
This entry covers one path to the bug. The description says it concerns the use-after-free when triggered via the interactive VCD parser inside the GTKWave GUI. The wider advisory covers several related VCD parsing flaws in the same release, each with its own CVE for a different entry point. The weakness class is CWE-416 (use after free).
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild. It also does not name a fixed upstream version. The Debian LTS announcement linked from the record is the place to look for packaged fix versions.
How to check if you're exposed
Find out whether GTKWave is installed and which version you have. On Debian or Ubuntu style systems:
dpkg -l gtkwave
gtkwave --version
On other systems use the package manager query for your distribution, or look at the version string the application reports. If you build GTKWave from source, check the tag you built from. Version 3.3.115 is the one named in the record, so treat it as exposed until a vendor advisory tells you otherwise.
Also ask who handles VCD files from outside your team. The GUI is used by people, so the question is who opens waveform dumps they received.
What to do now
- Inventory every machine, container image and CI runner that has GTKWave installed, and note the version.
- Read the Debian LTS announcement and the Talos report linked in the record to find the fixed package version for your distribution, then update.
- Until you have updated, do not open VCD files from sources you do not trust, and do not feed them to the conversion utilities.
- If the GUI is wired into an automated job, move that job to a throwaway container with no secrets and no network access.
- Rescan your dependency manifests and images after the update so the finding closes.
Why it matters
The flaw sits in a file parser. VCD (value change dump) files are text produced by simulators and logic tools, and GTKWave reads them into memory structures. In this case the problem is a use-after-free in the VCD get_vartoken realloc code. When a parser mishandles memory, a specially built file can steer what the program does next. The advisory says that can end in arbitrary code execution as the user who opened the file.
It matters most in hardware, FPGA and verification teams, where waveform dumps get passed around by email, tickets and shared drives. A file from a partner or a download feels like data, not code. Treating it as untrusted input is the practical defence. The same release has several sibling CVEs, so patching once clears the whole group when the vendor fix covers them.
Try it yourself
Fastest way to answer "do we even run this tool?" is an inventory of what is installed and where. This demo walks through that view.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be online for this to matter?
No. The attack is local and needs a person or a script to open a crafted VCD file. The risk comes from where the file came from, not from a network service.
Is there a fixed version in the record?
No. The record only names 3.3.115 as affected. Use the linked Debian LTS announcement or your own vendor advisory for the fixed package version.
Sources
- Talos report TALOS-2023-1806 (linked from the NVD record; it could not be retrieved when we reviewed it)
- Debian LTS announcement (linked from the record; it could not be retrieved when we reviewed it)
- CVE-2023-37575 on Gold
Last reviewed: 19 October 2026.
