CVE-2022-23804 — Stack-based Buffer Overflow in Kicad

CWE-121 — Stack-based Buffer OverflowCWE-787 — Out-of-bounds Write6 documents5 sources
Severity
7.8HIGHNVD
OSV7.5
EPSS
0.9%
top 23.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Kicad EDAFreedesktop PopplerDebian Kicad+3 more
Timeline
PublishedFeb 16
Latest updateApr 28

Description

A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/kicad< kicad 6.0.2+dfsg-1 (bookworm)
▶Debiankicad/kicad_eda< 5.1.9+dfsg1-1+deb11u1+3
▶NVDkicad/eda6.0.1
▶Ubuntufreedesktop/poppler< 0.86.1-0ubuntu1.4+3

Also affects: Debian Linux 10.0, 11.0, 9.0, Fedora 35

🔴Vulnerability Details

3
OSV
poppler vulnerabilities↗2023-11-23
▶
GHSA
GHSA-ffgm-4qmx-xp28: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord coordinate parsing functionality of KiCad EDA↗2022-02-17
▶
OSV
CVE-2022-23804: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord coordinate parsing functionality of KiCad EDA↗2022-02-16
▶

📋Vendor Advisories

2
Ubuntu
KiCad vulnerabilities↗2025-04-28
▶
Debian
CVE-2022-23804: kicad - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber a...↗2022
▶
CVE-2022-23804 — Stack-based Buffer Overflow in Kicad | cvebase