CVE-2021-40401
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 1.3%
exploitation probability
1.3%top 30% of all CVEs
observed exploitation
nono source reports it
In short
Gerbv has a bug where it tries to use data that was already deleted from memory when reading specially-crafted gerber files. An attacker can exploit this to run harmful code on your computer.
Technical detail
A use-after-free vulnerability in RS-274X aperture tokenization allows an attacker to supply a malicious gerber file that triggers memory corruption, leading to arbitrary code execution. The vulnerability affects versions 2.7.0, dev (commit b5f1eacd), and forked 2.7.1 of Gerbv with no authentication or user interaction required beyond file processing.
Summary generated and translated by AI from the official description.
A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H
Affected products
n/a · Gerbv