CVE-2023-38583 is a high severity (CVSS 7.8) stack-based buffer overflow in the LXT2 reader of GTKWave 3.3.115. Opening a crafted .lxt2 file can lead to code execution. Debian's LTS advisory fixed it by moving to a newer upstream release, so update GTKWave and avoid untrusted waveform files.
What's affected
The affected product is GTKWave, the waveform viewer, version 3.3.115. The flaw is a stack-based buffer overflow in the lxt2_rd_expand_integer_to_bits function in the LXT2 reader. The record says a specially crafted .lxt2 file can lead to arbitrary code execution and that the victim would need to open it. The record is dated 2024-01-08 and scores 7.8, High, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The record references Talos report TALOS-2023-1827 and a Debian LTS announcement. Talos's site blocked my request. Debian's announcement, DLA-3785-1 of 9 April 2024, covers a long list of GTKWave CVEs including this one, and says Debian fixed them by upgrading to a more recent upstream version. For Debian 10 buster the fixed package version is 3.3.98+really3.3.118-0+deb10u1. For other platforms, I could not confirm an upstream fixed release number from the sources, so use the newest GTKWave and check your distribution.
Weakness class: CWE-120, CWE-787.
How to check if you're exposed
Check the installed version.
gtkwave --version
dpkg -l gtkwave # Debian and Ubuntu
On Debian 10 the fixed package is 3.3.98+really3.3.118-0+deb10u1 or later. Check other distributions' trackers for the fix. Also look for copies of GTKWave inside hardware design toolchains and container images, which do not update with the system package.
What to do now
- Find GTKWave installs on engineering workstations, build servers and container images.
- Update to the newest release, or the patched package from your distribution.
- On Debian 10, install 3.3.98+really3.3.118-0+deb10u1 or later.
- Do not open waveform files from untrusted sources until you have updated.
- Treat waveform dumps from outside your team like any other untrusted file.
Why it matters
A stack buffer overflow copies data into a fixed size area on the call stack without checking its length. Because the stack also holds control information, an overflow can redirect what the program runs next. File readers are common sites for it because the file author controls all the numbers and lengths.
GTKWave has had a long run of file format flaws, as the length of the Debian advisory shows. A reader of many formats written by many tools is hard to harden one bug at a time, so the real defence is to update promptly and treat waveform files like any other untrusted input. The CVE is not on the CISA Known Exploited Vulnerabilities list.
A classic buffer overflow copies data into a fixed-size buffer without checking that it fits. On the stack, the overflow can overwrite control data and redirect execution. File parsers are common victims because file contents are fully under the file author's control.
An out-of-bounds write puts data outside the memory the program meant to use. It is one of the most serious memory safety classes because it can corrupt neighbouring data or control structures. Bounds checks, memory-safe languages and fuzzing of parsers are the standard defences.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the libraries a project declares, and reachability analysis helps show whether a vulnerable library is actually called. Copies bundled inside other products need your own inventory as well.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Debian version fixes it?
For Debian 10 buster, Debian's LTS advisory lists 3.3.98+really3.3.118-0+deb10u1.
Do I have to open a file to be at risk?
Yes. The record says the victim has to open a crafted file, so the risk centres on untrusted waveform files.
Sources
Last reviewed: 19 October 2026.
