CVE-2022-33889 - A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 could be used to write beyond the allocated heap buffer

Back Back to CVE browser

HIGH

A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 could be used to write beyond the allocated heap buffer

Published Oct 3, 2022

7.8

HIGH

CVSS 3.1

EPSS 0.39%

Description

A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 could be used to write beyond the allocated heap buffer. This vulnerability could lead to arbitrary code execution.

Affected products

Vendor n/a Product Autodesk® Design Review, Autodesk® Advance Steel, Autodesk® Civil 3D® Default
unknown
Affected
- 2018, 2023, 2022

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Autodesk® Design Review, Autodesk® Advance Steel, Autodesk® Civil 3D®	unknown	Affected 2018, 2023, 2022

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-36927
Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0021
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-36927		Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0021		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner autodesk

Published Oct 3, 2022

Updated Aug 3, 2024

Reserved Jun 16, 2022

Link CVE-2022-33889

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-33889

Red Hat

No data

ENISA EUVD

Assigner autodesk

Published Oct 3, 2022

Updated Aug 3, 2024

Link EUVD-2022-36927

GitHub

No data