CVE-2023-39317: High Integer Overflow in GTKWave LXT2 Dict Lengths

CVE-2023-39317 is a high severity (CVSS 7.8) integer overflow in GTKWave 3.3.115. A crafted .lxt2 file can lead to code execution when a user opens it. This entry concerns the string_lens allocation in the dictionary entry handling. No fixed version appears in the record, so check your distribution advisory.

What's affected

The NVD record names one product: GTKWave 3.3.115 from Tony Bybell. Linux distributions package the tool too, so the same code can sit behind a distro package name. The score is 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

The description places the flaw in the LXT2 num_dict_entries functionality and says it concerns the integer overflow when allocating the string_lens array. A sibling CVE covers the other array in the same code. The weakness class is CWE-190 (integer overflow or wraparound).

The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild. No fixed version is given in the record. Treat 3.3.115 as exposed until your vendor says otherwise.

In plain terms the vector means a local attack. It needs no account on the machine, but it does need a person to open the file. The impact on confidentiality, integrity and availability is rated high.

How to check if you're exposed

GTKWave is usually installed from a distribution package, so ask the package manager first.

dpkg -l gtkwave
gtkwave --version
rpm -q gtkwave

Use the line that matches your system. The record names version 3.3.115 as affected. If you build from source, check the tag you built from. Then look for stray inputs: ask the people who run simulations whether they open .lxt2 files that came from outside the team, and check shared drives and ticket attachments for them.

What to do now

1. List every workstation, container image and CI runner that has GTKWave installed, with the version.
2. Open the Debian LTS announcement and the Talos report linked from the record, then find the fixed package for your distribution and update. The record does not name a fixed upstream version, so confirm it from the advisory.
3. Until the update is in, do not open .lxt2 files from outside sources, and do not pass them to any tool that reads the same format.
4. If a job opens waveform files automatically, run it in a disposable container with no secrets and no network access.
5. Patch this CVE together with its sibling CVE-2023-39316 and CVE-2023-39317 so both dictionary allocations are covered.
6. Rescan after patching so the finding closes in your inventory.

Why it matters

LXT2 files can carry a dictionary of strings, and GTKWave reads a count of entries from the file before it reserves memory for them. In this case the code allocates the string_lens array from that count. If the multiplication wraps around, the buffer ends up too small for what the loop writes next. The advisory says this can lead to arbitrary code execution.

Because the count comes from the file itself, whoever made the file controls the input to the calculation. That is the pattern behind most parser bugs of this kind. The fix for the class is to check the size before allocating. Until your distribution ships that, keep untrusted waveform dumps away from the tool.

Quick check

Sources

• Talos report TALOS-2023-1820 (listed in the NVD record; the page blocked automated access when we tried to read it, so this post relies on the NVD description)
• Debian LTS announcement, April 2024 (listed in the NVD record; it could not be loaded here, check it for packaged fix versions)
• Safeguard Gold entry for CVE-2023-39317

Last reviewed: 19 October 2026.