CVE-2023-29076

During parsing of a maliciously crafted file in one of the supported formats (MODEL, SLDASM, SAT, CATPART), improper memory management occurs (CWE-119 — buffer overflow/memory corruption). The flaw causes corruption of the process memory structure, which in combination with other vulnerabilities can be exploited to execute arbitrary code in the context of the current application process. The attack requires no authentication or system-side interaction beyond the user opening the file.

An attacker can trigger arbitrary code execution (RCE) in the context of the AutoCAD process, potentially resulting in system compromise, data theft, or malware installation.

Apply patches available from the vendor according to references (https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018). Users should avoid opening MODEL, SLDASM, SAT, and CATPART files from untrusted sources until updates are installed.

Autodesk AutoCAD 2023 and 2024, and Autodesk AutoCAD Advance Steel (versions indicated in vendor references)