CVE-2023-35995

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 1.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-129

Affected software

No affected versions have been published.

Timeline

Published
Jan 8, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-359967.8Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A speciaCVE-2023-359977.8Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A speciaCVE-2023-359984.6A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network CVE-2023-36008.8During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This vCVE-2023-360006.5A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attackeCVE-2023-360024.3A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on CVE-2023-360037.3XAML Diagnostics Elevation of Privilege VulnerabilityCVE-2023-360047.5Windows DPAPI (Data Protection Application Programming Interface) Spoofing VulnerabilityCVE-2023-360058.1Windows Telephony Server Elevation of Privilege VulnerabilityCVE-2023-360068.8Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityCVE-2023-360074.1Microsoft Send Customer Voice survey from Dynamics 365 Spoofing VulnerabilityCVE-2023-360086.6Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability