CVE-2021-40166

CWE-416 — Use After Free3 documents3 sources
Severity
7.8HIGH
EPSS
0.1%
top 69.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
19
Autodesk AutocadAutodesk Autocad Advance SteelAutodesk Autocad Architecture+16 more
Timeline
PublishedOct 7

Description

A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by attackers to execute arbitrary code.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages19 packages

▶NVDautodesk/revit2019 — 2019.2.4+3
▶NVDautodesk/fusion2.0.10356 — 2.0.11405
▶NVDautodesk/autocad2019 — 2019.1.4+3
▶NVDautodesk/inventor2019 — 2019.6+3
▶NVDautodesk/autocad_lt2019 — 2019.1.4+6

🔴Vulnerability Details

2
CVEList
CVE-2021-40166: A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsi↗2022-10-07
▶
GHSA
GHSA-mfx9-gcm4-c79c: A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsi↗2022-10-07
▶
CVE-2021-40166 (HIGH CVSS 7.8) | A maliciously crafted PNG file in A | cvebase.io