CVE-2023-39444 is a high severity (CVSS 7.8) out-of-bounds write in GTKWave 3.3.115. A crafted .lxt2 file can lead to code execution when a user opens it. This entry concerns the string copy loop. The record names no fixed version, so check your distribution advisory.
What's affected
The NVD record names one product: GTKWave 3.3.115 from Tony Bybell. Linux distributions package the tool too, so the same code can sit behind a distro package name. The score is 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The description says multiple out-of-bounds writes exist in the LXT2 parsing functionality and that this entry concerns the write performed by the string copy loop. The weakness class is CWE-119 (improper restriction of operations within the bounds of a memory buffer).
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild. No fixed version is given in the record. Treat 3.3.115 as exposed until your vendor says otherwise.
In plain terms the vector means a local attack. It needs no account on the machine, but it does need a person to open the file. The impact on confidentiality, integrity and availability is rated high.
How to check if you're exposed
GTKWave is usually installed from a distribution package, so ask the package manager first.
dpkg -l gtkwave
gtkwave --version
rpm -q gtkwave
Use the line that matches your system. The record names version 3.3.115 as affected. If you build from source, check the tag you built from. Then look for stray inputs: ask the people who run simulations whether they open .lxt2 files that came from outside the team, and check shared drives and ticket attachments for them.
What to do now
- List every workstation, container image and CI runner that has GTKWave installed, with the version.
- Open the Debian LTS announcement and the Talos report linked from the record, then find the fixed package for your distribution and update. The record does not name a fixed upstream version, so confirm it from the advisory.
- Until the update is in, do not open
.lxt2files from outside sources, and do not pass them to any tool that reads the same format. - If a job opens waveform files automatically, run it in a disposable container with no secrets and no network access.
- Patch this CVE with its sibling (CVE-2023-39443 is the prefix copy loop, CVE-2023-39444 the string copy loop).
- Rescan after patching so the finding closes in your inventory.
Why it matters
An out-of-bounds write happens when a loop copies more bytes than the destination buffer holds. Here the string copy loop in the LXT2 parser is the place it happens. The data being copied comes from the file, and so does the length, so a crafted file can decide how far the write runs.
Writes past the end of a buffer are among the more serious memory bugs because they can change nearby data, including pointers the program uses later. The advisory states the end result can be arbitrary code execution. As with the rest of this group, the entry point is a file a person opens, so the control that works today is not opening files you do not trust.
Quick check
Can someone exploit this over the network?
Not directly. The vector is local and needs a user to open a crafted file. The risk comes from where the file came from, such as an email, a ticket or a shared drive, and not from a listening service.
Do the two copy loop CVEs need separate fixes?
They are separate identifiers for two writes in the same parser. A package that fixes the parsing code should cover both, but confirm that in the distribution advisory.
Sources
- Talos report TALOS-2023-1826 (listed in the NVD record; the page blocked automated access when we tried to read it, so this post relies on the NVD description)
- Debian LTS announcement, April 2024 (listed in the NVD record; it could not be loaded here, check it for packaged fix versions)
- Safeguard Gold entry for CVE-2023-39444
Last reviewed: 19 October 2026.
