CVE-2023-39414 is a high severity (CVSS 7.0) integer underflow in GTKWave 3.3.115. A crafted .lxt2 file can cause memory corruption when a user opens it. This entry covers the right shift operation in the radix iteration code. The record names no fixed version, so check your distribution advisory.
What's affected
The NVD record names one product: GTKWave 3.3.115 from Tony Bybell. Linux distributions package the tool too, so the same code can sit behind a distro package name. The score is 7.0 (High) with the vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
The description places the flaw in the LXT2 lxt2_rd_iter_radix shift operation functionality and says it concerns the integer underflow when performing the right shift operation. The weakness class is CWE-191 (integer underflow or wraparound).
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild. No fixed version is given in the record. Treat 3.3.115 as exposed until your vendor says otherwise.
The vector differs from the other GTKWave LXT2 entries in one place: attack complexity is rated high, which is why the score is 7.0 and not 7.8. The record describes the result as memory corruption, where the sibling overflow entries say arbitrary code execution. The attack is local and needs a user to open the file.
How to check if you're exposed
GTKWave is usually installed from a distribution package, so ask the package manager first.
dpkg -l gtkwave
gtkwave --version
rpm -q gtkwave
Use the line that matches your system. The record names version 3.3.115 as affected. If you build from source, check the tag you built from. Then look for stray inputs: ask the people who run simulations whether they open .lxt2 files that came from outside the team, and check shared drives and ticket attachments for them.
What to do now
- List every workstation, container image and CI runner that has GTKWave installed, with the version.
- Open the Debian LTS announcement and the Talos report linked from the record, then find the fixed package for your distribution and update. The record does not name a fixed upstream version, so confirm it from the advisory.
- Until the update is in, do not open
.lxt2files from outside sources, and do not pass them to any tool that reads the same format. - If a job opens waveform files automatically, run it in a disposable container with no secrets and no network access.
- Handle this CVE with its sibling (CVE-2023-39413 and CVE-2023-39414 are the left and right shift variants) in a single update.
- Rescan after patching so the finding closes in your inventory.
Why it matters
A shift operation moves the bits of a number. If the shift amount is computed from file data and goes below zero, the result is undefined in C, and the program can end up using a wrong value for an offset or size. The advisory ties the right shift in lxt2_rd_iter_radix to memory corruption.
Memory corruption in a viewer is not always as direct as code execution, and the high complexity rating reflects that. It is still worth fixing, because the same crafted file is the input for the whole family of GTKWave 3.3.115 bugs. The practical defence is the same: keep untrusted files away and take the distribution update.
Quick check
Why is this scored lower than the other GTKWave LXT2 bugs?
The vector marks attack complexity as high and the description says memory corruption rather than code execution. That gives 7.0 instead of 7.8. Still High severity.
Can someone exploit this over the network?
Not directly. The vector is local and needs a user to open a crafted file. The risk comes from where the file came from, such as an email, a ticket or a shared drive, and not from a listening service.
Sources
- Talos report TALOS-2023-1824 (listed in the NVD record; the page blocked automated access when we tried to read it, so this post relies on the NVD description)
- Debian LTS announcement, April 2024 (listed in the NVD record; it could not be loaded here, check it for packaged fix versions)
- Safeguard Gold entry for CVE-2023-39414
Last reviewed: 19 October 2026.
