CVE-2024-8590 — Autodesk AutoCAD 3DM File Parsing Use-After-Free Code Execution Vulnerability

Description (CNA)

A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.

Affected (CNA)

Vendor / product	Versions
Autodesk / AutoCAD	affected 2025 before 2025.1.1; affected 2024 before 2024.1.7; affected 2023 before 2023.1.7; affected 2022 before 2022.1.6
Autodesk / AutoCAD Architecture	affected 2025 before 2025.1.1; affected 2024 before 2024.1.7; affected 2023 before 2023.1.7; affected 2022 before 2022.1.6
Autodesk / AutoCAD Electrical	affected 2025 before 2025.1.1; affected 2024 before 2024.1.7; affected 2023 before 2023.1.7; affected 2022 before 2022.1.6
Autodesk / AutoCAD MAP 3D	affected 2025 before 2025.1.1; affected 2024 before 2024.1.7; affected 2023 before 2023.1.7; affected 2022 before 2022.1.6
Autodesk / AutoCAD Mechanical	affected 2025 before 2025.1.1; affected 2024 before 2024.1.7; affected 2023 before 2023.1.7; affected 2022 before 2022.1.6
Autodesk / AutoCAD MEP	affected 2025 before 2025.1.1; affected 2024 before 2024.1.7; affected 2023 before 2023.1.7; affected 2022 before 2022.1.6
Autodesk / AutoCAD Plant 3D	affected 2025 before 2025.1.1; affected 2024 before 2024.1.7; affected 2023 before 2023.1.7; affected 2022 before 2022.1.6
Autodesk / Civil 3D	affected 2025 before 2025.1.1; affected 2024 before 2024.1.7; affected 2023 before 2023.1.7; affected 2022 before 2022.1.6
Autodesk / Advance Steel	affected 2025 before 2025.1.1; affected 2024 before 2024.1.7; affected 2023 before 2023.1.7; affected 2022 before 2022.1.6

CWE

CWE-416

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.