CVE-2023-38657: High LXT2 Out-of-Bounds Write in GTKWave in GTKWave

CVE-2023-38657 is a High severity flaw (CVSS 7.8) in GTKWave 3.3.115: an out-of-bounds write during zlib block decompression in the LXT2 zlib block decompression code. A crafted .lxt2 file can lead to arbitrary code execution, but only if someone opens it. The record names no fixed version, so read the Talos and Debian advisories and update through your distribution.

What's affected

The record lists one affected product: GTKWave 3.3.115 (CPE tonybybell:gtkwave:3.3.115). GTKWave is a waveform viewer used by hardware and FPGA engineers to inspect simulation output, and the flaw sits in the LXT2 zlib block decompression code, which handles the LXT2 format.

We could not confirm a fixed upstream version. The Talos report (TALOS-2023-1823) was not retrievable when this was reviewed, and the Debian LTS announcement in the record needs a browser to load. Read both for the exact patched package versions before you decide a given install is safe. Older and newer releases are not named in the record, so treat other versions as unconfirmed rather than safe.

Related CVEs from the same research are tracked separately, including CVE-2023-39270 and CVE-2023-39271 in the LXT2 facgeometry parser. Check each one against the advisory rather than assuming a single update covers the set.

How to check if you're exposed

GTKWave is usually installed as an operating system package, so start with your package manager. On Debian or Ubuntu:

dpkg -l gtkwave
apt policy gtkwave

On Fedora or RHEL style systems:

rpm -q gtkwave

On macOS with Homebrew:

brew list --versions gtkwave

Compare the result to the fixed package version named in your distribution's advisory. Distributions often backport fixes without changing the upstream version number, so a version string alone can mislead you. Also look at build images, shared lab workstations and containers, where GTKWave tends to be installed once and forgotten.

What to do now

1. Find every machine and image that has GTKWave installed, including lab VMs and CI or verification containers.
2. Update GTKWave to the package your distribution lists as fixed. Use the Debian LTS announcement referenced in the record if you run Debian.
3. Until patched, do not open .lxt2 or other waveform files from sources you do not trust. Treat files from outside your team the same way you treat an unknown spreadsheet macro.
4. If you must inspect an untrusted waveform, do it in a disposable virtual machine with no access to source repositories or credentials.
5. Remove GTKWave from images that do not need a viewer, and re-scan to confirm nothing still reports 3.3.115.

Why it matters

An out-of-bounds write means the parser stores data past the end of the buffer it was given. Because the data comes from the file, the file's author influences what gets overwritten, which is why advisories for this class mention code execution.

The weakness classes are CWE-119 (improper restriction of operations within a memory buffer) and CWE-787 (out-of-bounds write). The vector is local with user interaction (AV:L, UI:R), and attack complexity is low. That means no one can reach this over the network by itself. Someone has to get a crafted .lxt2 file in front of an engineer, for example through a shared test bench, a contractor hand-off or an artifact pulled from an untrusted pipeline.

The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. That keeps the urgency moderate, but engineering workstations often hold design files and credentials, so an unpatched viewer is still worth closing out.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Talos report TALOS-2023-1823 (listed in the record; blocked from automated access when reviewed)
• Debian LTS announcement, April 2024 (listed in the record; needs a browser to load)
• Record data for CVE-2023-38657: NVD description, CVSS vector and CWE list

Last reviewed: 19 October 2026.