CVE-2021-40161

CWE-787 — Out-of-bounds WriteCWE-4273 documents3 sources
Severity
7.8HIGH
EPSS
0.1%
top 80.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
Autodesk Advance SteelAutodesk AutocadAutodesk Autocad Architecture+10 more
Timeline
PublishedDec 23
Latest updateDec 24

Description

A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through PDFTron earlier than 9.0.7 version.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages13 packages

▶NVDautodesk/revit2021 — 2021.1.6+2
▶NVDautodesk/autocad2020 — 2020.1.5+7
▶NVDautodesk/civil_3d2020 — 2020.1.5+3
▶NVDautodesk/autocad_lt2020 — 2020.1.5+6
▶NVDautodesk/navisworks2020 — 2020.4+3

Patches

Patch: www.autodesk.com ↗Patch: www.autodesk.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-v4wc-276h-mcm2: A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through PDF earlier than 9↗2021-12-24
▶
CVEList
CVE-2021-40161: A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through PDFTron earlier than 9↗2021-12-23
▶
CVE-2021-40161 (HIGH CVSS 7.8) | A Memory Corruption vulnerability m | cvebase.io