CVE-2024-23136

Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software

State: Published
Severity: 7.8 High
Published: Feb 22, 2024
Updated: Aug 26, 2025
Reserved: Jan 11, 2024

Description

A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	autodesk

Weaknesses

CWE-822 Untrusted Pointer Dereference

Affected Products

Product	Versions
AutoCADAutodesk	2025 to before 2025.0.1Affected 2024 to before 2024.1.3Affected 2023 to before 2023.1.5Affected 2022 to before 2022.1.4Affected 2021 to before 2021.1.4Affected
AutoCAD ArchitectureAutodesk	2025 to before 2025.0.1Affected 2024 to before 2024.1.3Affected 2023 to before 2023.1.5Affected 2022 to before 2022.1.4Affected 2021 to before 2021.1.4Affected
AutoCAD ElectricalAutodesk	2025 to before 2025.0.1Affected 2024 to before 2024.1.3Affected 2023 to before 2023.1.5Affected 2022 to before 2022.1.4Affected 2021 to before 2021.1.4Affected
AutoCAD MechanicalAutodesk	2025 to before 2025.0.1Affected 2024 to before 2024.1.3Affected 2023 to before 2023.1.5Affected 2022 to before 2022.1.4Affected 2021 to before 2021.1.4Affected
AutoCAD MEPAutodesk	2025 to before 2025.0.1Affected 2024 to before 2024.1.3Affected 2023 to before 2023.1.5Affected 2022 to before 2022.1.4Affected 2021 to before 2021.1.4Affected
AutoCAD Plant 3DAutodesk	2025 to before 2025.0.1Affected 2024 to before 2024.1.3Affected 2023 to before 2023.1.5Affected 2022 to before 2022.1.4Affected 2021 to before 2021.1.4Affected
Civil 3DAutodesk	2025 to before 2025.0.1Affected 2024 to before 2024.1.3Affected 2023 to before 2023.1.5Affected 2022 to before 2022.1.4Affected 2021 to before 2021.1.4Affected
Advance SteelAutodesk	2025 to before 2025.0.1Affected 2024 to before 2024.1.3Affected 2023 to before 2023.1.5Affected 2022 to before 2022.1.4Affected 2021 to before 2021.1.4Affected
AutoCAD MAP 3DAutodesk	2025 to before 2025.0.1Affected 2024 to before 2024.1.3Affected 2023 to before 2023.1.5Affected 2022 to before 2022.1.4Affected 2021 to before 2021.1.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.