CVE-2022-23803 — Stack-based Buffer Overflow in Kicad

CWE-121 — Stack-based Buffer OverflowCWE-787 — Out-of-bounds Write5 documents5 sources
Severity
7.8HIGHNVD
EPSS
1.3%
top 20.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Kicad EDADebian KicadDebian Linux+2 more
Timeline
PublishedFeb 16
Latest updateApr 28

Description

A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/kicad< kicad 6.0.2+dfsg-1 (bookworm)
▶Debiankicad/kicad_eda< 5.1.9+dfsg1-1+deb11u1+3
▶NVDkicad/eda6.0.1

Also affects: Debian Linux 10.0, 11.0, 9.0, Fedora 35

🔴Vulnerability Details

2
GHSA
GHSA-vr3r-85rj-x4p4: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord coordinate parsing functionality of KiCad EDA↗2022-02-17
▶
OSV
CVE-2022-23803: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord coordinate parsing functionality of KiCad EDA↗2022-02-16
▶

📋Vendor Advisories

2
Ubuntu
KiCad vulnerabilities↗2025-04-28
▶
Debian
CVE-2022-23803: kicad - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber a...↗2022
▶
CVE-2022-23803 — Stack-based Buffer Overflow in Kicad | cvebase