CVE-2024-7673 — DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software

Description (CNA)

A maliciously crafted DWFX file, when parsed in w3dtk.dll through Autodesk Navisworks, can force a Heap-based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash or execute arbitrary code in the context of the current process.

Affected (CNA)

Vendor / product	Versions
Autodesk / Navisworks Freedom	affected 2025 before 2025.3; affected 2024 before 2024.3; affected 2023 before 2023.5; affected 2022 before 2022.6
Autodesk / Navisworks Simulate	affected 2025 before 2025.3; affected 2024 before 2024.3; affected 2023 before 2023.5; affected 2022 before 2022.6
Autodesk / Navisworks Manage	affected 2025 before 2025.3; affected 2024 before 2024.3; affected 2023 before 2023.5; affected 2022 before 2022.6

CWE

CWE-122

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0015

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.