A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities.

published 2023-06-27 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-32671

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits: 0; none known

A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities. These vulnerabilities in conjunction with other vulnerabilities could lead to code execution in the context of the current process.

Patch / fix

fixed in 17

autodesk alias 2023.1.1
autodesk autocad 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
autodesk autocad_advance_steel 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
autodesk autocad_architecture 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
autodesk autocad_civil_3d 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
autodesk autocad_electrical 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
autodesk autocad_lt 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
autodesk autocad_map_3d 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
autodesk autocad_mechanical 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
autodesk autocad_mep 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
autodesk autocad_plant_3d 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
autodesk infraworks 2021.2, 2022.1, 2023.1
autodesk inventor 2021.5, 2022.4, 2023.3.1
autodesk maya_usd 2022.5, 2023.3
autodesk navisworks 2022.4, 2023.2
autodesk revit 2021.1.8
autodesk vred 2023.4

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 23 mo ago (2024-12-05)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

n/a Autodesk products

Classification

Weakness

CWE-787 Out-of-bounds Write

References

autodesk.com /trust/security-advisories/adsk-sa-2023-0009
vendor-advisory

Sources

CVE List CVE-2023-29068
NVD CVE-2023-29068

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary