CRITICAL🇵🇱 Wersja polska

CVE-2023-29075

CVSS 9.8v3.1pub. 2023-11-23upd. 2024-11-21

A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

🤖 AI Analysis
How it works

During parsing of a PRT file by Autodesk AutoCAD, data is written outside the boundaries of the allocated memory buffer (Out-Of-Bounds Write). An attacker can provide a victim with a maliciously crafted PRT file, and opening it in a vulnerable version of the software will trigger a memory write error. The improper write can be exploited to seize control of the process execution flow and execute arbitrary code.

Impact

An attacker can cause the application to crash (DoS), read sensitive data from process memory, or execute arbitrary code (RCE) in the context of the current user process.

Mitigation & patch

Patches available from the manufacturer must be applied according to the references — detailed information about patched versions is available at https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018

Who is affected

Autodesk AutoCAD 2023 and 2024 and Autodesk AutoCAD Advance Steel (versions indicated in the manufacturer's references — advisory ADSK-SA-2023-0018)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Autodesk Autocad

    APP
    Autodesk
    < 2024.12023.0.0 – 2023.1.4 (bez)2024.0.0 – 2024.1.1 (bez)

  • Autodesk Autocad Advance Steel

    APP
    Autodesk
    < 2023.1.42024.0.0 – 2024.1.1 (bez)

  • Autodesk Autocad Architecture

    APP
    Autodesk
    < 2023.1.42024.0.0 – 2024.1.1 (bez)

  • Autodesk Autocad Civil 3d

    APP
    Autodesk
    < 2023.1.42024.0.0 – 2024.1.1 (bez)

  • Autodesk Autocad Electrical

    APP
    Autodesk
    < 2023.1.42024.0.0 – 2024.1.1 (bez)

  • Autodesk Autocad Lt

    APP
    Autodesk
    < 2023.1.4< 2024.12024.0.0 – 2024.1.1 (bez)

  • Autodesk Autocad Map 3d

    APP
    Autodesk
    < 2023.1.42024.0.0 – 2024.1.1 (bez)

  • Autodesk Autocad Mechanical

    APP
    Autodesk
    < 2023.1.42024.0.0 – 2024.1.1 (bez)

  • Autodesk Autocad Mep

    APP
    Autodesk
    < 2023.1.42024.0.0 – 2024.1.1 (bez)

  • Autodesk Autocad Plant 3d

    APP
    Autodesk
    < 2023.1.42024.0.0 – 2024.1.1 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEDoSMemory
CWE
References

Related vulnerabilities

CVE-2023-29076CRITICAL9.8PL ✓ten sam produkt

Autodesk AutoCAD — uszkodzenie pamięci przy parsowaniu plików 3D (RCE)

CVE-2023-29073CRITICAL9.8PL ✓ten sam produkt

Heap-Based Buffer Overflow w Autodesk AutoCAD przy parsowaniu pliku MODEL

CVE-2023-29074CRITICAL9.8PL ✓ten sam produkt

Autodesk AutoCAD: Out-Of-Bounds Write przy parsowaniu pliku CATPART

CVE-2026-0874HIGH7.8ten sam produkt

A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds ...

CVE-2026-0875HIGH7.8ten sam produkt

A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Wr...