CVE-2021-40401
CVE-2021-40401
In short
Gerbv has a bug where it tries to use data that was already deleted from memory when reading specially-crafted gerber files. An attacker can exploit this to run harmful code on your computer.
Technical detail
A use-after-free vulnerability in RS-274X aperture tokenization allows an attacker to supply a malicious gerber file that triggers memory corruption, leading to arbitrary code execution. The vulnerability affects versions 2.7.0, dev (commit b5f1eacd), and forked 2.7.1 of Gerbv with no authentication or user interaction required beyond file processing.
Summary generated and translated by AI from the official description.
A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H
Affected products
n/a · GerbvWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →