CVE-2023-37921: High Arbitrary Write in GTKWave vcd2vzt

CVE-2023-37921 is a high severity (CVSS 7.8) arbitrary write flaw in GTKWave 3.3.115, the waveform viewer. A crafted VCD file can lead to code execution when someone opens it with the vcd2vzt conversion utility. The record gives no fixed version, so check your distribution advisory and update the package.

What's affected

The NVD record names one product and version: GTKWave 3.3.115 from Tony Bybell (the project is also packaged by Linux distributions). The record scores the flaw 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms that is a local attack that needs no privileges but does need a user to open a file, with high impact on confidentiality, integrity and availability.

This entry covers one path to the bug. The description says it concerns the arbitrary write when triggered via the vcd2vzt conversion utility. The wider advisory covers several related VCD parsing flaws in the same release, each with its own CVE for a different entry point. The weakness class is CWE-118 (incorrect access of indexable resource).

The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild. It also does not name a fixed upstream version. The Debian LTS announcement linked from the record is the place to look for packaged fix versions.

How to check if you're exposed

Find out whether GTKWave is installed and which version you have. On Debian or Ubuntu style systems:

dpkg -l gtkwave
gtkwave --version

On other systems use the package manager query for your distribution, or look at the version string the application reports. If you build GTKWave from source, check the tag you built from. Version 3.3.115 is the one named in the record, so treat it as exposed until a vendor advisory tells you otherwise.

Also ask who handles VCD files from outside your team. The vcd2vzt utility is often run from scripts and build jobs, so check CI images and lab machines as well as developer laptops.

What to do now

1. Inventory every machine, container image and CI runner that has GTKWave installed, and note the version.
2. Read the Debian LTS announcement and the Talos report linked in the record to find the fixed package version for your distribution, then update.
3. Until you have updated, do not open VCD files from sources you do not trust, and do not feed them to the conversion utilities.
4. If vcd2vzt is wired into an automated job, move that job to a throwaway container with no secrets and no network access.
5. Rescan your dependency manifests and images after the update so the finding closes.

Why it matters

The flaw sits in a file parser. VCD (value change dump) files are text produced by simulators and logic tools, and GTKWave reads them into memory structures. In this case the problem is a arbitrary write in the VCD sorted bsearch code. When a parser mishandles memory, a specially built file can steer what the program does next. The advisory says that can end in arbitrary code execution as the user who opened the file.

It matters most in hardware, FPGA and verification teams, where waveform dumps get passed around by email, tickets and shared drives. A file from a partner or a download feels like data, not code. Treating it as untrusted input is the practical defence. The same release has several sibling CVEs, so patching once clears the whole group when the vendor fix covers them.

Try it yourself

Fixing the package once is the easy part. Knowing when a new tool shows up with a known flaw is the harder part, and this demo shows how continuous monitoring handles it.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Talos report TALOS-2023-1807 (linked from the NVD record; it could not be retrieved when we reviewed it)
• Debian LTS announcement (linked from the record; it could not be retrieved when we reviewed it)
• CVE-2023-37921 on Gold

Last reviewed: 19 October 2026.