CVE-2023-38649 – CVE-2023-38649 is an out-of-bounds write vulner... (How to Fix)

Q: What is the severity of CVE-2023-38649?

CVE-2023-38649 has a CVSS score of 7.8 (HIGH). CVE-2023-38649 is an out-of-bounds write vulnerability in GTKWave's VZT file decompression that allows arbitrary code execution when a malicious .vzt file is opened. This affects users of GTKWave 3.3.115 who open untrusted waveform files. Attackers can achieve remote code execution with user privileges.

📋 TL;DR

CVE-2023-38649 is an out-of-bounds write vulnerability in GTKWave's VZT file decompression that allows arbitrary code execution when a malicious .vzt file is opened. This affects users of GTKWave 3.3.115 who open untrusted waveform files. Attackers can achieve remote code execution with user privileges.

💻 Affected Systems

Products:

GTKWave

Versions: Version 3.3.115 specifically

Operating Systems: Linux, Windows, macOS - any OS running vulnerable GTKWave

Default Config Vulnerable: ⚠️ Yes

Notes: All installations of GTKWave 3.3.115 are vulnerable when processing .vzt files. The vulnerability is in the core decompression functionality.

📦 What is this software?

Gtkwave by Tonybybell

View all CVEs affecting Gtkwave →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise via arbitrary code execution with the privileges of the user running GTKWave, potentially leading to data theft, ransomware deployment, or lateral movement.

🟠

Likely Case

Local privilege escalation or malware installation when users open malicious .vzt files from untrusted sources.

🟢

If Mitigated

Limited impact if file execution is blocked or GTKWave runs in sandboxed/isolated environments.

🌐 Internet-Facing: LOW - GTKWave is typically not an internet-facing service, but malicious files could be delivered via web downloads.

🏢 Internal Only: MEDIUM - Internal users could be targeted via phishing or shared malicious files, leading to lateral movement within networks.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires user interaction (opening a malicious file). Public technical details exist in Talos reports, making weaponization likely.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 3.3.115 (check for updates from GTKWave repository)

Vendor Advisory: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html

Restart Required: No

Instructions:

1. Check current GTKWave version. 2. Download and install latest version from official GTKWave repository. 3. Verify installation. No restart required.

🔧 Temporary Workarounds

Block .vzt file processing

all

Prevent GTKWave from opening .vzt files via file association removal or application control.

On Linux: Remove .vzt MIME type association
On Windows: Remove file association via registry or group policy

Sandbox GTKWave execution

all

Run GTKWave in isolated environments like containers or virtual machines.

docker run --rm -v /path/to/files:/data gtkwave
Use Windows Sandbox or similar isolation

🧯 If You Can't Patch

Implement application whitelisting to block GTKWave execution entirely.
Educate users to never open .vzt files from untrusted sources and implement email/web filtering for .vzt attachments.

🔍 How to Verify

Check if Vulnerable:

Check GTKWave version: Run 'gtkwave --version' or check About dialog. If version is 3.3.115, system is vulnerable.

Check Version:

gtkwave --version

Verify Fix Applied:

After update, verify version is newer than 3.3.115 using 'gtkwave --version' command.

📡 Detection & Monitoring

Log Indicators:

GTKWave crash logs with memory access violations
Unexpected process creation from GTKWave

Network Indicators:

Downloads of .vzt files from untrusted sources
Unusual outbound connections from systems running GTKWave

SIEM Query:

Process creation where parent_process contains 'gtkwave' AND (process_name not in ['expected_child_processes']) OR File creation where extension='.vzt' AND source_ip not in trusted_networks

📊 Metadata

CVE ID: CVE-2023-38649

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-119

Published: January 8, 2024

Last Updated: November 4, 2025

🔗 References

https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1813 Exploit,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1813 Exploit,Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1813

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-38649, you might also want to check these: