CVE-2024-9996 - Autodesk AutoCAD DWG File Parsing Out-Of-Bounds Write Code Execution Vulnerability

Back Back to CVE browser

HIGH

Autodesk AutoCAD DWG File Parsing Out-Of-Bounds Write Code Execution Vulnerability

Published Oct 29, 2024

7.8

HIGH

CVSS 3.1

EPSS 0.21%

Description

A maliciously crafted DWG file, when parsed in acdb25.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

Affected products

Vendor Autodesk Product Advance Steel Default
unaffected
Affected
- ≥ 2022, < 2022.1.6
- ≥ 2023, < 2023.1.7
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1
Vendor Autodesk Product AutoCAD Default
unaffected
Affected
- ≥ 2022, < 2022.1.6
- ≥ 2023, < 2023.1.7
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1
Vendor Autodesk Product AutoCAD Architecture Default
unaffected
Affected
- ≥ 2022, < 2022.1.6
- ≥ 2023, < 2023.1.7
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1
Vendor Autodesk Product AutoCAD Electrical Default
unaffected
Affected
- ≥ 2022, < 2022.1.6
- ≥ 2023, < 2023.1.7
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1
Vendor Autodesk Product AutoCAD LT Default
unaffected
Affected
- ≥ 2022, < 2022.1.6
- ≥ 2023, < 2023.1.7
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1
Vendor Autodesk Product AutoCAD MAP 3D Default
unaffected
Affected
- ≥ 2022, < 2022.1.6
- ≥ 2023, < 2023.1.7
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1
Vendor Autodesk Product AutoCAD MEP Default
unaffected
Affected
- ≥ 2022, < 2022.1.6
- ≥ 2023, < 2023.1.7
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1
Vendor Autodesk Product AutoCAD Mechanical Default
unaffected
Affected
- ≥ 2022, < 2022.1.6
- ≥ 2023, < 2023.1.7
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1
Vendor Autodesk Product AutoCAD Plant 3D Default
unaffected
Affected
- ≥ 2022, < 2022.1.6
- ≥ 2023, < 2023.1.7
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1
Vendor Autodesk Product Civil 3D Default
unaffected
Affected
- ≥ 2022, < 2022.1.6
- ≥ 2023, < 2023.1.7
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1
Vendor Autodesk Product DWG TrueView Default
unaffected
Affected
- ≥ 2023, < 2023.1.7
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1
Vendor Autodesk Product RealDWG Default
unaffected
Affected
- ≥ 2024, < 2024.1.7
- ≥ 2025, < 2025.1.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Autodesk	Advance Steel	unaffected	Affected ≥ 2022, < 2022.1.6 ≥ 2023, < 2023.1.7 ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1
Autodesk	AutoCAD	unaffected	Affected ≥ 2022, < 2022.1.6 ≥ 2023, < 2023.1.7 ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1
Autodesk	AutoCAD Architecture	unaffected	Affected ≥ 2022, < 2022.1.6 ≥ 2023, < 2023.1.7 ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1
Autodesk	AutoCAD Electrical	unaffected	Affected ≥ 2022, < 2022.1.6 ≥ 2023, < 2023.1.7 ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1
Autodesk	AutoCAD LT	unaffected	Affected ≥ 2022, < 2022.1.6 ≥ 2023, < 2023.1.7 ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1
Autodesk	AutoCAD MAP 3D	unaffected	Affected ≥ 2022, < 2022.1.6 ≥ 2023, < 2023.1.7 ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1
Autodesk	AutoCAD MEP	unaffected	Affected ≥ 2022, < 2022.1.6 ≥ 2023, < 2023.1.7 ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1
Autodesk	AutoCAD Mechanical	unaffected	Affected ≥ 2022, < 2022.1.6 ≥ 2023, < 2023.1.7 ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1
Autodesk	AutoCAD Plant 3D	unaffected	Affected ≥ 2022, < 2022.1.6 ≥ 2023, < 2023.1.7 ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1
Autodesk	Civil 3D	unaffected	Affected ≥ 2022, < 2022.1.6 ≥ 2023, < 2023.1.7 ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1
Autodesk	DWG TrueView	unaffected	Affected ≥ 2023, < 2023.1.7 ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1
Autodesk	RealDWG	unaffected	Affected ≥ 2024, < 2024.1.7 ≥ 2025, < 2025.1.1