Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure

Summary: Cisco Talos discovered seven vulnerabilities in Gerbv, the open-source viewer for RS-274X Gerber, Excellon drill and pick-and-place files, all in the function that opens Gerber files. Four (CVE-2021-40391, CVE-2021-40393, CVE-2021-40394, CVE-2021-40401) could allow arbitrary code execution and three (CVE-2021-40400, CVE-2021-40402, CVE-2021-40403) cause out-of-bounds reads that could expose process memory or any file on the system, and no update was available as of Feb. 28, 2022.
What's compelling: Gerbv 2.7.0, forked 2.7.1, forked 2.8.0 and dev commit b5f1eacd are affected, and with no fix available, anyone opening a crafted circuit-board file - in the GUI or through the library - is exposed to code execution or file exfiltration.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-40391 CVE-2021-40393 CVE-2021-40394 CVE-2021-40400 CVE-2021-40401 CVE-2021-40402 CVE-2021-40403
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026