Cloudanix VulnDB

CVE-2022-23946

High · 7.8

CVSS

7.8

EPSS

1.7%

Published

Feb 4, 2022

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A specially crafted design file can let an attacker take over a computer when someone opens it in the KiCad viewer program.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Remote Code Execution
Component
Application
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Stack-based buffer overflow in Gerber Viewer GCodeNumber parsing of Gerber and Excellon files allowing arbitrary code execution.

Why it matters to the business

Engineers opening malicious design files can have their workstations compromised, risking theft or tampering of hardware designs and downstream supply-chain exposure.

How an attack unfolds

An attacker creates a Gerber or Excellon file containing an oversized GCodeNumber token that overflows the stack buffer during parsing in KiCad 6.0.1 or the vulnerable master commit; when the victim opens the file the overflow is triggered and attacker-controlled code runs with the privileges of the KiCad process.

How to fix it

Upgrade KiCad to a version containing the fix for the Gerber Viewer parsing routines; on Fedora and Debian apply the vendor-supplied security updates for the kicad package.

How to confirm the fix worked

Confirm the installed KiCad version is newer than 6.0.1 and that the de006fc010 commit or later is present; attempt to open a test file containing a long GCodeNumber token and verify the application does not crash or execute unexpected code.

Typical attack path

  1. Craft a malicious Gerber or Excellon file containing an oversized GCodeNumber value
  2. Deliver the file to the target via email, file share, or download link
  3. Victim opens the file in the Gerber Viewer component of KiCad
  4. Buffer overflow occurs during GCodeNumber parsing and leads to code execution

How to detect it

Review system and application logs for abnormal process creation immediately after KiCad Gerber Viewer execution; inspect recent file-access timestamps for Gerber or Excellon files originating from untrusted sources.

What your security team should do

  • Immediately update all KiCad installations to a patched release
  • Block or sandbox receipt of untrusted Gerber and Excellon files
  • Inventory systems running Fedora or Debian packages and apply vendor updates
  • Monitor for any new public exploits targeting this parsing code

The record

A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 kicad 0 5.0.2+dfsg1-1+deb10u1
Debian:11 kicad 0 5.1.9+dfsg1-1+deb11u1
Debian:12 kicad 0 6.0.2+dfsg-1
Debian:13 kicad 0 6.0.2+dfsg-1
Debian:9 kicad 0 4.0.5+dfsg1-4+deb9u1
Mageia:8 kicad 0 5.1.12-1.1.mga8
Ubuntu:20.04:LTS kicad 0 No fix
Ubuntu:22.04:LTS kicad 0 No fix
Ubuntu:24.04:LTS kicad 0 No fix
Ubuntu:24.10 kicad 0 No fix
Ubuntu:Pro:16.04:LTS kicad 0 No fix
Ubuntu:Pro:18.04:LTS kicad 0 No fix
Ubuntu:Pro:18.04:LTS kicad 0 4.0.7+dfsg1-1ubuntu2+esm1
Ubuntu:Pro:20.04:LTS kicad 0 5.1.5+dfsg1-2ubuntu0.1~esm1

Related vulnerabilities