CVE-2023-25002

CWE-416 — Use After Free3 documents3 sources
Severity
7.8HIGH
EPSS
0.3%
top 46.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Autodesk 3DS MAXAutodesk NavisworksAutodesk Revit+1 more
Timeline
PublishedJun 27
Latest updateJun 28

Description

A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶NVDautodesk/vred2023
▶NVDautodesk/revit2022, 2023+1
▶NVDautodesk/3ds_max2022, 2023+1
▶NVDautodesk/navisworks2022, 2023+1
▶CVEListV5multiple2023, 2022, 2021

🔴Vulnerability Details

2
GHSA
GHSA-p642-fwhv-jwmj: A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability↗2023-06-28
▶
CVEList
CVE-2023-25002: A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability↗2023-06-27
▶
CVE-2023-25002 (HIGH CVSS 7.8) | A maliciously crafted SKP file in A | cvebase.io