CVE-2022-23946 — Stack-based Buffer Overflow in Kicad

CWE-121 — Stack-based Buffer OverflowCWE-787 — Out-of-bounds Write5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.8%
top 26.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Kicad EDADebian KicadDebian Linux+1 more
Timeline
PublishedFeb 4
Latest updateApr 28

Description

A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/kicad< kicad 6.0.2+dfsg-1 (bookworm)
▶Debiankicad/kicad_eda< 5.1.9+dfsg1-1+deb11u1+3
▶CVEListV5kicad/kicad_edaKiCad EDA 6.0.1,KiCad EDA master commit de006fc010
▶NVDkicad/kicad_eda6.0.1

Also affects: Debian Linux 10.0, 11.0, 9.0, Fedora 35

🔴Vulnerability Details

2
GHSA
GHSA-5xw6-g598-2v26: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6↗2022-02-12
▶
OSV
CVE-2022-23946: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6↗2022-02-04
▶

📋Vendor Advisories

2
Ubuntu
KiCad vulnerabilities↗2025-04-28
▶
Debian
CVE-2022-23946: kicad - A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber a...↗2022
▶
CVE-2022-23946 — Stack-based Buffer Overflow in Kicad | cvebase