Autodesk Advance Steel vulnerabilities

CVE-2024-23143 [HIGH] CWE-125 CVE-2024-23143: A maliciously crafted 3DM, MODEL and X_B file, when parsed in ASMkern229A.dll and ASMBASE229A.dll th A maliciously crafted 3DM, MODEL and X_B file, when parsed in ASMkern229A.dll and ASMBASE229A.dll through Autodesk applications, can force an Out-of-Bound Read and/or Out-of-Bound Write. A malicious actor can leverage this vulnerability to cause a crash,read sensitive data, or execute arbitrary code in the context of the current process.

CVE-2024-23151 [HIGH] CWE-787 CVE-2024-23151: A maliciously crafted 3DM file, when parsed in ASMkern229A.dll through Autodesk AutoCAD, may force a A maliciously crafted 3DM file, when parsed in ASMkern229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVE-2024-23154 [HIGH] CWE-122 CVE-2024-23154: A maliciously crafted SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can b A maliciously crafted SLDPRT file, when parsed in ODXSW_DLL.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVE-2024-37001 [HIGH] CWE-122 CVE-2024-37001: A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can be u A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVE-2024-23150 [HIGH] CWE-787 CVE-2024-23150: A maliciously crafted PRT file, when parsed in odxug_dll.dll through Autodesk AutoCAD, may force an A maliciously crafted PRT file, when parsed in odxug_dll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVE-2025-1432 [HIGH] CWE-416 CVE-2025-1432: A maliciously crafted 3DM file, when parsed through Autodesk AutoCAD, can force a Use-After-Free vul A maliciously crafted 3DM file, when parsed through Autodesk AutoCAD, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVE-2025-1277 [HIGH] CWE-120 CVE-2025-1277: A maliciously crafted PDF file, when parsed through Autodesk applications, can force a Memory Corrup A maliciously crafted PDF file, when parsed through Autodesk applications, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVE-2025-1430 [HIGH] CWE-120 CVE-2025-1430: A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force a Memory Corrupti A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVE-2025-1274 [HIGH] CWE-787 CVE-2025-1274: A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVE-2024-7992 [HIGH] CWE-121 CVE-2024-7992: A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based produ A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force a Stack-based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVE-2024-9997 [HIGH] CWE-120 CVE-2024-9997: A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force a Memory A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.

CVE-2024-8600 [HIGH] CWE-119 CVE-2024-8600: A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.

CVE-2024-9996 [HIGH] CWE-787 CVE-2024-9996: A maliciously crafted DWG file, when parsed in acdb25.dll through Autodesk AutoCAD, may force an Out A maliciously crafted DWG file, when parsed in acdb25.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVE-2024-8593 [HIGH] CWE-787 CVE-2024-8593: A maliciously crafted CATPART file, when parsed in ASMKERN230A.dll through Autodesk AutoCAD, may for A maliciously crafted CATPART file, when parsed in ASMKERN230A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVE-2024-8596 [HIGH] CWE-787 CVE-2024-8596: A maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force a A maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVE-2024-8597 [HIGH] CWE-119 CVE-2024-8597: A maliciously crafted STP file when parsed in ASMDATAX230A.dll through Autodesk AutoCAD can force a A maliciously crafted STP file when parsed in ASMDATAX230A.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.

CVE-2024-7305 [HIGH] CWE-787 CVE-2024-7305: A maliciously crafted DWF file, when parsed in AdDwfPdk.dll through Autodesk AutoCAD, may force an O A maliciously crafted DWF file, when parsed in AdDwfPdk.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVE-2024-8896 [HIGH] CWE-908 CVE-2024-8896: A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to acces A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.

CVE-2025-5048 [HIGH] CWE-120 CVE-2025-5048: A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force a Memory Co A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

CVE-2022-25789 [HIGH] CWE-416 CVE-2022-25789: A maliciously crafted DWF, 3DS and DWFX files in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used A maliciously crafted DWF, 3DS and DWFX files in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.