CVE-2022-23947

What it actually does

Stack-based buffer overflow in Gerber Viewer DCodeNumber parsing allows attacker-controlled input to overwrite the call stack and achieve arbitrary code execution.

Why it matters to the business

Users who open malicious design files risk full compromise of their workstation, enabling theft of intellectual property, deployment of ransomware, or lateral movement inside engineering networks.

How an attack unfolds

An attacker crafts a gerber or excellon file containing an oversized DCodeNumber field. When the victim opens the file in the Gerber Viewer, the parser overflows the stack buffer, hijacks control flow, and executes attacker-supplied code without further user interaction beyond opening the file.

How to fix it

Upgrade KiCad EDA to a version newer than 6.0.1 that contains the corrected DCodeNumber parsing logic; rebuild from source after commit de006fc010 if using development builds; avoid opening untrusted gerber or excellon files until patched.

How to confirm the fix worked

Confirm the installed KiCad version is greater than 6.0.1, test that the Gerber Viewer rejects or safely handles sample files containing oversized DCodeNumber fields, and verify no crash or unexpected code execution occurs.

Typical attack path

1. Attacker creates a gerber or excellon file with a malicious DCodeNumber value exceeding the allocated buffer
2. Victim receives and opens the file in KiCad EDA Gerber Viewer
3. Parser copies the oversized value onto the stack without bounds checking
4. Return address is overwritten, redirecting execution to attacker-controlled shellcode
5. Arbitrary code runs with the privileges of the KiCad process

How to detect it

Inspect system logs and process execution history for KiCad Gerber Viewer crashes immediately after opening gerber or excellon files; look for unusually large numeric fields inside those files during forensic review of recent engineering projects.

• gerbview.exe
• DCodeNumber parsing
• .gbr files with numeric tokens exceeding 100 characters
• .drl files containing repeated digit sequences in coordinate blocks

What your security team should do

• Immediately restrict opening of gerber and excellon files from untrusted sources
• Deploy the latest patched KiCad release across all engineering workstations
• Add gerber and excellon file types to email and download scanning policies
• Monitor for any new public exploit code targeting this parsing flaw