CVE-2024-23136 json
Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
published 2024-02-22 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-20655
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
Patch / fix
- Autodesk AutoCAD 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD Architecture 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD Electrical 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD Mechanical 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD MEP 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD Plant 3D 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk Civil 3D 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk Advance Steel 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD MAP 3D 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- autodesk autocad_advance_steel 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- autodesk autocad_civil_3d 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
- Autodesk AutoCAD
- Autodesk AutoCAD Architecture
- Autodesk AutoCAD Electrical
- Autodesk AutoCAD Mechanical
- Autodesk AutoCAD MEP
- Autodesk AutoCAD Plant 3D
- Autodesk Civil 3D
- Autodesk Advance Steel
- Autodesk AutoCAD MAP 3D
- autodesk autocad_advance_steel
- autodesk autocad_civil_3d
Classification
- Weakness
-
- CWE-822 Untrusted Pointer Dereference
References
-
autodesk.com
/trust/security-advisories/adsk-sa-2024-0002
vendor-advisory
-
autodesk.com
/trust/security-advisories/adsk-sa-2024-0004
vendor-advisory
Sources
- CVE List CVE-2024-23136
- NVD CVE-2024-23136
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.