CVE-2021-40165

CWE-787 — Out-of-bounds Write3 documents3 sources
Severity
7.8HIGH
EPSS
0.1%
top 69.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
19
Autodesk AutocadAutodesk Autocad Advance SteelAutodesk Autocad Architecture+16 more
Timeline
PublishedOct 7

Description

A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages19 packages

▶NVDautodesk/revit2019 — 2019.2.4+3
▶NVDautodesk/fusion2.0.10356 — 2.0.11405
▶NVDautodesk/autocad2019 — 2019.1.4+3
▶NVDautodesk/inventor2019 — 2019.6+3
▶NVDautodesk/autocad_lt2019 — 2019.1.4+6

🔴Vulnerability Details

2
GHSA
GHSA-953g-4f76-943p: A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer while parsi↗2022-10-07
▶
CVEList
CVE-2021-40165: A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer while parsi↗2022-10-07
▶
CVE-2021-40165 (HIGH CVSS 7.8) | A maliciously crafted TIFF | cvebase.io