CVE-2022-33886
published 2022-10-03CVE-2022-33886: A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2022, 2021, 2020, and…
PriorityP339high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.96%
57.7th percentile
A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2022, 2021, 2020, and Maya 2023 and 2022. The vulnerability exists because the application fails to handle crafted MODEL and SLDPRT files, which causes an unhandled exception. A malicious actor could leverage this vulnerability to execute arbitrary code.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| autodesk | autocad | >= 2022 < 2022.1.3 | 2022.1.3 |
| autodesk | autocad | >= 2023 < 2023.1.1 | 2023.1.1 |
| autodesk | autocad_advance_steel | >= 2022 < 2022.1.3 | 2022.1.3 |
| autodesk | autocad_advance_steel | >= 2023 < 2023.1.1 | 2023.1.1 |
| autodesk | autocad_architecture | >= 2022 < 2022.1.3 | 2022.1.3 |
| autodesk | autocad_architecture | >= 2023 < 2023.1.1 | 2023.1.1 |
| autodesk | autocad_civil_3d | >= 2022 < 2022.1.3 | 2022.1.3 |
| autodesk | autocad_civil_3d | >= 2023 < 2023.1.1 | 2023.1.1 |
| autodesk | autocad_electrical | >= 2022 < 2022.1.3 | 2022.1.3 |
| autodesk | autocad_electrical | >= 2023 < 2023.1.1 | 2023.1.1 |
| autodesk | autocad_lt | >= 2022 < 2022.1.3 | 2022.1.3 |
| autodesk | autocad_lt | >= 2023 < 2023.1.1 | 2023.1.1 |
| autodesk | autocad_map_3d | >= 2022 < 2022.1.3 | 2022.1.3 |
| autodesk | autocad_map_3d | >= 2023 < 2023.1.1 | 2023.1.1 |
| autodesk | autocad_mechanical | >= 2022 < 2022.1.3 | 2022.1.3 |
| autodesk | autocad_mechanical | >= 2023 < 2023.1.1 | 2023.1.1 |
| autodesk | autocad_mep | >= 2022 < 2022.1.3 | 2022.1.3 |
| autodesk | autocad_mep | >= 2023 < 2023.1.1 | 2023.1.1 |
| autodesk | autocad_plant_3d | >= 2022 < 2022.1.3 | 2022.1.3 |
| autodesk | autocad_plant_3d | >= 2023 < 2023.1.1 | 2023.1.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-10-03
Published