CVE-2023-35995 - Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115

Back Back to CVE browser

HIGH

Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115

Published Jan 8, 2024

7.8

HIGH

CVSS 3.1

EPSS 0.41%

Description

Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 1.

Affected products

Vendor GTKWave Product GTKWave Default
n/a
- Version
  3.3.115
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GTKWave

n/a

Version	Status	Constraints
3.3.115	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-129

References (3)

Link	Providers	Tags
https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1791		ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1791

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner talos

Published Jan 8, 2024

Updated Nov 4, 2025

Reserved Jun 20, 2023

Link CVE-2023-35995

CISA Vulnrichment

Updated Jan 8, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-35995

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-35995