CVE-2022-23804

What it actually does

Stack-based buffer overflow in the ReadIJCoord coordinate parsing function within the Gerber Viewer component allows an attacker-supplied Gerber or Excellon file to overwrite the stack and achieve arbitrary code execution.

Why it matters to the business

Organizations using KiCad for PCB design face risk of workstation compromise when designers open untrusted fabrication files, potentially leading to loss of intellectual property, supply-chain tampering, or further lateral movement.

How an attack unfolds

An attacker crafts a Gerber or Excellon file containing an oversized coordinate string that triggers the overflow in ReadIJCoord. The file is delivered to a target user who opens it with KiCad's Gerber Viewer; the overflow is triggered during parsing and control flow is redirected to attacker-supplied code.

How to fix it

Upgrade KiCad EDA to a version containing the fix for the ReadIJCoord buffer handling (post-6.0.1 / after commit de006fc010). Where an immediate update is not possible, avoid opening untrusted Gerber or Excellon files and sandbox the application.

How to confirm the fix worked

Confirm the installed KiCad version is newer than 6.0.1 and that the vulnerable commit de006fc010 is no longer present; test by attempting to load both benign and known-malformed coordinate files under controlled conditions to verify the overflow is no longer reachable.

Typical attack path

1. Create a malformed Gerber or Excellon file that overflows the stack buffer in ReadIJCoord
2. Host or transmit the malicious file to the victim (email, shared drive, download link)
3. Victim opens the file using KiCad EDA Gerber Viewer
4. Coordinate parsing routine overflows the stack and executes attacker payload

How to detect it

Review file-access and process-creation logs around KiCad executions for unusual Gerber or Excellon files; inspect recent files opened by the Gerber Viewer component and correlate with any unexpected child processes or crashes.

What your security team should do

• Prioritize patching all KiCad installations to a fixed release
• Add policy requiring review or sandboxing of external fabrication files before opening
• Monitor for new KiCad releases and subscribe to upstream security announcements
• Consider application allow-listing or containerization for design tools handling untrusted files