CVE-2024-23136 — Untrusted Pointer Dereference in Advance Steel

CWE-822 — Untrusted Pointer Dereference3 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.4%
top 41.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Autodesk Advance SteelAutodesk AutocadAutodesk Autocad Architecture+6 more
Timeline
PublishedFeb 22

Description

A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages18 packages

▶CVEListV5autodesk/autocad2025 — 2025.0.1+4
▶NVDautodesk/autocad2021 — 2021.1.4+4
▶CVEListV5autodesk/civil_3d2025 — 2025.0.1+4
▶NVDautodesk/civil_3d2021 — 2021.1.4+4
▶CVEListV5autodesk/autocad_mep2025 — 2025.0.1+4

🔴Vulnerability Details

2
CVEList
Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software↗2024-02-22
▶
GHSA
GHSA-rxxm-q32v-2mc5: A maliciously crafted STP file when ASMKERN228A↗2024-02-22
▶
CVE-2024-23136 — Untrusted Pointer Dereference | cvebase