CVE-2021-40401 | A use-after-free vulnerability exists in the RS-274X apertur… | CVSS 10.0 CRITICAL

Description

A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Metadata

CVE ID: CVE-2021-40401
State: PUBLISHED
Assigner: talos
Reserved: 2021-09-01 00:00 UTC
Published: 2022-02-04 00:00 UTC
Last updated: 2025-04-15 19:12 UTC
Primary CWE: CWE-252
CWE-252: Unchecked Return Value
Vendor / Product: n/a / Gerbv
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
n/a	Gerbv	—	Gerbv 2.7.0 ,Gerbv forked 2.7.1 ,Gerbv dev (commit b5f1eacd)

Weakness (CWE)

CWE	Source	Description
CWE-252	cna	CWE-252: Unchecked Return Value

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H

References (3)