CVE-2023-39270: High LXT2 rows Array Integer Overflow in GTKWave

CVE-2023-39270 is a High severity flaw (CVSS 7.8) in GTKWave 3.3.115: an integer overflow when the rows array is allocated in the LXT2 facgeometry parser. A crafted .lxt2 file can lead to arbitrary code execution, but only if someone opens it. The record names no fixed version, so read the Talos and Debian advisories and update through your distribution.

What's affected

The record lists one affected product: GTKWave 3.3.115 (CPE tonybybell:gtkwave:3.3.115). GTKWave is a waveform viewer used by hardware and FPGA engineers to inspect simulation output, and the flaw sits in the LXT2 facgeometry parser, which handles the LXT2 format.

We could not confirm a fixed upstream version. The Talos report (TALOS-2023-1818) was not retrievable when this was reviewed, and the Debian LTS announcement in the record needs a browser to load. Read both for the exact patched package versions before you decide a given install is safe. Older and newer releases are not named in the record, so treat other versions as unconfirmed rather than safe.

Related CVEs from the same research are tracked separately, including CVE-2023-39271, which covers the msb array in the same parser. Check each one against the advisory rather than assuming a single update covers the set.

How to check if you're exposed

GTKWave is usually installed as an operating system package, so start with your package manager. On Debian or Ubuntu:

dpkg -l gtkwave
apt policy gtkwave

On Fedora or RHEL style systems:

rpm -q gtkwave

On macOS with Homebrew:

brew list --versions gtkwave

Compare the result to the fixed package version named in your distribution's advisory. Distributions often backport fixes without changing the upstream version number, so a version string alone can mislead you. Also look at build images, shared lab workstations and containers, where GTKWave tends to be installed once and forgotten.

What to do now

1. Find every machine and image that has GTKWave installed, including lab VMs and CI or verification containers.
2. Update GTKWave to the package your distribution lists as fixed. Use the Debian LTS announcement referenced in the record if you run Debian.
3. Until patched, do not open .lxt2 or other waveform files from sources you do not trust. Treat files from outside your team the same way you treat an unknown spreadsheet macro.
4. If you must inspect an untrusted waveform, do it in a disposable virtual machine with no access to source repositories or credentials.
5. Remove GTKWave from images that do not need a viewer, and re-scan to confirm nothing still reports 3.3.115.

Why it matters

An integer overflow here means a size calculation wraps around, so the program asks for less memory than the file data needs. Later writes into that buffer then land outside it. That is the usual route from a malformed file to memory corruption.

The weakness class is CWE-190 (integer overflow or wraparound). The vector is local with user interaction (AV:L, UI:R), and attack complexity is low. That means no one can reach this over the network by itself. Someone has to get a crafted .lxt2 file in front of an engineer, for example through a shared test bench, a contractor hand-off or an artifact pulled from an untrusted pipeline.

The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. That keeps the urgency moderate, but engineering workstations often hold design files and credentials, so an unpatched viewer is still worth closing out.

Quick check

Sources

• Talos report TALOS-2023-1818 (listed in the record; blocked from automated access when reviewed)
• Debian LTS announcement, April 2024 (listed in the record; needs a browser to load)
• Record data for CVE-2023-39270: NVD description, CVSS vector and CWE list

Last reviewed: 19 October 2026.