CVE-2023-35994

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta initialization part.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-129

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-359957.8Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specia CVE-2023-359967.8Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specia CVE-2023-359977.8Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specia CVE-2023-359984.6A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network CVE-2023-36008.8During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This v CVE-2023-360006.5A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacke CVE-2023-360024.3A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on CVE-2023-360037.3XAML Diagnostics Elevation of Privilege Vulnerability CVE-2023-360047.5Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability CVE-2023-360058.1Windows Telephony Server Elevation of Privilege Vulnerability CVE-2023-360068.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2023-360074.1Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability