CVE-2024-23138 — Stack-based Overflow Vulnerability in the TrueViewTM Desktop Software

Description (CNA)

A maliciously crafted DWG file when parsed through Autodesk DWG TrueView can be used to cause a Stack-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Affected (CNA)

Vendor / product	Versions
Autodesk / AutoCAD	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.1.4; affected 2021 before 2021.1.4
Autodesk / AutoCAD Architecture	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.1.4; affected 2021 before 2021.1.4
Autodesk / AutoCAD Electrical	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.1.4; affected 2021 before 2021.1.4
Autodesk / AutoCAD Mechanical	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.1.4; affected 2021 before 2021.1.4
Autodesk / AutoCAD MEP	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.1.4; affected 2021 before 2021.1.4
Autodesk / AutoCAD Plant 3D	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.1.4; affected 2021 before 2021.1.4
Autodesk / Civil 3D	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.1.4; affected 2021 before 2021.1.4
Autodesk / Advance Steel	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.1.4; affected 2021 before 2021.1.4
Autodesk / AutoCAD MAP 3D	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.1.4; affected 2021 before 2021.1.4
Autodesk / AutoCAD LT	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.1.4; affected 2021 before 2021.1.4
Autodesk / AutoCAD Mac	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.4.1
Autodesk / AutoCAD LT for Mac	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.4.1
Autodesk / DWG TrueView	affected 2024 before 2024.1.3; affected 2023 before 2023.1.5; affected 2022 before 2022.1.4

CWE

CWE-121

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0006

ADP enrichment

CVE

No English description supplied.

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0006

CISA-ADP

No English description supplied.

No references supplied.