CVE-2023-38618 is a high severity (CVSS 7.8) integer overflow in the VZT facgeometry parsing of GTKWave 3.3.115, where the rows array is allocated. Opening a crafted .vzt file can lead to code execution. Debian LTS fixed it by upgrading to a newer upstream release, so update GTKWave.
What's affected
The affected product is GTKWave, version 3.3.115. The record describes multiple integer overflows in the VZT facgeometry parsing functionality, and this CVE concerns the overflow when allocating the rows array. A specially crafted .vzt file can lead to arbitrary code execution, and the victim would need to open it. The record is dated 2024-01-08 and scores 7.8, High, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The record references Talos report TALOS-2023-1812, which I could not load, and Debian's LTS announcement DLA-3785-1. That announcement lists this CVE among many GTKWave fixes and says Debian resolved them by upgrading to a more recent upstream version. For Debian 10 buster the fixed package is 3.3.98+really3.3.118-0+deb10u1. For other systems, check your distribution, since I could not confirm an upstream fixed release number directly.
Weakness class: CWE-190.
How to check if you're exposed
Read the installed version.
gtkwave --version
dpkg -l gtkwave # Debian and Ubuntu
On Debian 10, look for 3.3.98+really3.3.118-0+deb10u1 or later. Elsewhere, compare with your distribution's tracker. Also check hardware design tool bundles and container images that carry their own copy of GTKWave.
What to do now
- Find GTKWave on engineering workstations, build servers and images.
- Update to the latest release or the patched distribution package.
- On Debian 10, install 3.3.98+really3.3.118-0+deb10u1 or later.
- Avoid opening .vzt and other waveform files from untrusted sources.
- Review this alongside CVE-2023-38583, which affects the same version through the LXT2 reader.
Why it matters
This is an integer overflow in how the parser sizes an array. The file supplies the dimensions, the program multiplies them, and the result wraps around to a small number. The array is then smaller than the data the parser goes on to write. Because the file author sets the dimensions, they set the size of the mismatch.
The pattern repeats across GTKWave's many readers, which is why Debian's fix was to take a whole newer upstream version rather than patch one function. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the sources do not report exploitation. A simple rule serves well: treat waveform files from outside your team as untrusted input.
An integer overflow happens when arithmetic on a size or count produces a number too large for its type, so it wraps around to a small value. If that wrapped value is then used to size a memory allocation, the program reserves too little space and later writes more data than fits. The safe pattern is to check the arithmetic before it is used, and to reject any file or message whose declared sizes do not add up.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the libraries a project declares, and reachability analysis helps show whether a vulnerable library is actually called. Copies bundled inside other products need your own inventory as well.
Quick check
Is this the same bug as CVE-2023-38583?
No. It affects the same GTKWave version but a different reader and weakness: an integer overflow in VZT parsing, against a stack overflow in LXT2.
What fixes it on Debian 10?
Debian's advisory lists 3.3.98+really3.3.118-0+deb10u1.
Sources
Last reviewed: 19 October 2026.
