Riskcovery

CVE-2024-23142

Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software

State
Published
Severity
7.8 High
Published
Jun 25, 2024
Updated
Aug 26, 2025
Reserved
Jan 11, 2024

Read the record on cve.org

Description

A maliciously crafted CATPART, STP, and MODEL file, when parsed in atf_dwg_consumer.dll, rose_x64_vc15.dll and libodxdll through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability, along with other vulnerabilities, can lead to code execution in the current process.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hautodesk

Weaknesses

Affected Products

ProductVersions
AutoCADAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD ArchitectureAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD ElectricalAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD MechanicalAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD MEPAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD Plant 3DAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
Civil 3DAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
Advance SteelAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD MAP 3DAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.