CVE-2023-39235: High VZT Autosort Write, Time Ticks Loop in GTKWave

CVE-2023-39235 is a High severity flaw (CVSS 7.8) in GTKWave 3.3.115: an out-of-bounds write when looping over lt->num_time_ticks in the vzt_rd_process_block autosort code. A crafted .vzt file can lead to arbitrary code execution, but only if someone opens it. The record names no fixed version, so read the Talos and Debian advisories and update through your distribution.

What's affected

The record lists one affected product: GTKWave 3.3.115 (CPE tonybybell:gtkwave:3.3.115). GTKWave is a waveform viewer used by hardware and FPGA engineers to inspect simulation output, and the flaw sits in the vzt_rd_process_block autosort code, which handles the VZT format.

We could not confirm a fixed upstream version. The Talos report (TALOS-2023-1817) was not retrievable when this was reviewed, and the Debian LTS announcement in the record needs a browser to load. Read both for the exact patched package versions before you decide a given install is safe. Older and newer releases are not named in the record, so treat other versions as unconfirmed rather than safe.

Related CVEs from the same research are tracked separately, including CVE-2023-39234, which covers the loop over lt->numrealfacs. Check each one against the advisory rather than assuming a single update covers the set.

How to check if you're exposed

GTKWave is usually installed as an operating system package, so start with your package manager. On Debian or Ubuntu:

dpkg -l gtkwave
apt policy gtkwave

On Fedora or RHEL style systems:

rpm -q gtkwave

On macOS with Homebrew:

brew list --versions gtkwave

Compare the result to the fixed package version named in your distribution's advisory. Distributions often backport fixes without changing the upstream version number, so a version string alone can mislead you. Also look at build images, shared lab workstations and containers, where GTKWave tends to be installed once and forgotten.

What to do now

1. Find every machine and image that has GTKWave installed, including lab VMs and CI or verification containers.
2. Update GTKWave to the package your distribution lists as fixed. Use the Debian LTS announcement referenced in the record if you run Debian.
3. Until patched, do not open .vzt or other waveform files from sources you do not trust. Treat files from outside your team the same way you treat an unknown spreadsheet macro.
4. If you must inspect an untrusted waveform, do it in a disposable virtual machine with no access to source repositories or credentials.
5. Remove GTKWave from images that do not need a viewer, and re-scan to confirm nothing still reports 3.3.115.

Why it matters

An out-of-bounds write means the parser stores data past the end of the buffer it was given. Because the data comes from the file, the file's author influences what gets overwritten, which is why advisories for this class mention code execution.

The weakness class is CWE-129 (improper validation of an array index). The vector is local with user interaction (AV:L, UI:R), and attack complexity is low. That means no one can reach this over the network by itself. Someone has to get a crafted .vzt file in front of an engineer, for example through a shared test bench, a contractor hand-off or an artifact pulled from an untrusted pipeline.

The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. That keeps the urgency moderate, but engineering workstations often hold design files and credentials, so an unpatched viewer is still worth closing out.

Quick check

Sources

• Talos report TALOS-2023-1817 (listed in the record; blocked from automated access when reviewed)
• Debian LTS announcement, April 2024 (listed in the record; needs a browser to load)
• Record data for CVE-2023-39235: NVD description, CVSS vector and CWE list

Last reviewed: 19 October 2026.