CVE-2023-41139CWE-119CWE-822

CVE-2023-41139

High · published November 23, 2023

CVSS v3.1
7.8
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00275 · 18.9th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-822 · Untrusted Pointer Dereference
Published
2023-11-23T09:15Z
Affected products (22)
ProductVersionsFixed in
autodesk/autocad< 2024.12024.1
autodesk/autocad≥ 2023.0.0, < 2023.1.42023.1.4
autodesk/autocad≥ 2024.0.0, < 2024.1.12024.1.1
autodesk/autocad_advance_steel< 2023.1.42023.1.4
autodesk/autocad_advance_steel≥ 2024.0.0, < 2024.1.12024.1.1
autodesk/autocad_architecture< 2023.1.42023.1.4
autodesk/autocad_architecture≥ 2024.0.0, < 2024.1.12024.1.1
autodesk/autocad_civil_3d< 2023.1.42023.1.4
autodesk/autocad_civil_3d≥ 2024.0.0, < 2024.1.12024.1.1
autodesk/autocad_electrical< 2023.1.42023.1.4
autodesk/autocad_electrical≥ 2024.0.0, < 2024.1.12024.1.1
autodesk/autocad_lt< 2023.1.42023.1.4
autodesk/autocad_lt< 2024.12024.1
autodesk/autocad_lt≥ 2024.0.0, < 2024.1.12024.1.1
autodesk/autocad_map_3d< 2023.1.42023.1.4
autodesk/autocad_map_3d≥ 2024.0.0, < 2024.1.12024.1.1
autodesk/autocad_mechanical< 2023.1.42023.1.4
autodesk/autocad_mechanical≥ 2024.0.0, < 2024.1.12024.1.1
autodesk/autocad_mep< 2023.1.42023.1.4
autodesk/autocad_mep≥ 2024.0.0, < 2024.1.12024.1.1
autodesk/autocad_plant_3d< 2023.1.42023.1.4
autodesk/autocad_plant_3d≥ 2024.0.0, < 2024.1.12024.1.1
References (2)
https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018 · [email protected]https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 23 NOV 03:53Z
    A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer
    cvelistv5