A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2…

published 2022-10-03 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-36924

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits: 0; none known

A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2022, 2021, 2020, and Maya 2023 and 2022. The vulnerability exists because the application fails to handle crafted MODEL and SLDPRT files, which causes an unhandled exception. A malicious actor could leverage this vulnerability to execute arbitrary code.

Patch / fix

fixed in 10

autodesk autocad 2022.1.3, 2023.1.1
autodesk autocad_advance_steel 2022.1.3, 2023.1.1
autodesk autocad_architecture 2022.1.3, 2023.1.1
autodesk autocad_civil_3d 2022.1.3, 2023.1.1
autodesk autocad_electrical 2022.1.3, 2023.1.1
autodesk autocad_lt 2022.1.3, 2023.1.1
autodesk autocad_map_3d 2022.1.3, 2023.1.1
autodesk autocad_mechanical 2022.1.3, 2023.1.1
autodesk autocad_mep 2022.1.3, 2023.1.1
autodesk autocad_plant_3d 2022.1.3, 2023.1.1

Exploit prediction

1.01% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

n/a Autodesk Maya

Classification

Weakness

CWE-755 Improper Handling of Exceptional Conditions

References

autodesk.com /trust/security-advisories/adsk-sa-2022-0020
vendor-advisory

Sources

CVE List CVE-2022-33886
NVD CVE-2022-33886

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary