Remote code execution in Autodesk AutoCAD and desktop products
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2024-8592 |
| CWE-ID | CWE-119 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Autodesk AutoCAD Other software / Other software solutions AutoCAD Architecture Client/Desktop applications / Multimedia software AutoCAD Electrical Client/Desktop applications / Multimedia software AutoCAD Mechanical Client/Desktop applications / Multimedia software AutoCAD MEP Client/Desktop applications / Multimedia software AutoCAD Plant 3D Client/Desktop applications / Multimedia software Autodesk Civil 3D Client/Desktop applications / Multimedia software |
| Vendor | Autodesk |
Security Bulletin
This security bulletin contains one high risk vulnerability.
1) Buffer overflow
EUVDB-ID: #VU99504
Risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-8592
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in AcTranslators.exe. A remote attacker can create a specially crafted CATPART file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAutodesk AutoCAD: 2024
AutoCAD Architecture: 2024
AutoCAD Electrical: 2024
AutoCAD Mechanical: 2024
AutoCAD MEP: 2024
AutoCAD Plant 3D: 2024
Autodesk Civil 3D: 2024
CPE2.3- cpe:2.3:a:autodesk:autodesk_autocad:*:*:*:*:*:*:*:*
- cpe:2.3:a:autodesk:autocad_architecture:2024:*:*:*:*:*:*:*
- cpe:2.3:a:autodesk:autocad_electrical:2024:*:*:*:*:*:*:*
- cpe:2.3:a:autodesk:autocad_mechanical:2024:*:*:*:*:*:*:*
- cpe:2.3:a:autodesk:autocad_mep:2024:*:*:*:*:*:*:*
- cpe:2.3:a:autodesk:autocad_plant_3d:2024:*:*:*:*:*:*:*
- cpe:2.3:a:autodesk:autodesk_civil_3d:2024:*:*:*:*:*:*:*
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0020
https://www.zerodayinitiative.com/advisories/ZDI-24-1452/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
