Riskcovery

CVE-2024-37002

Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software

State
Published
Severity
7.8 High
Published
Jun 25, 2024
Updated
Aug 27, 2025
Reserved
May 30, 2024

Read the record on cve.org

Description

A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hautodesk

Weaknesses

  • CWE-457 Use of Uninitialized Variable

Affected Products

ProductVersions
AutoCADAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD ArchitectureAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD ElectricalAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD MechanicalAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD MEPAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD Plant 3DAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
Civil 3DAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
Advance SteelAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected
AutoCAD MAP 3DAutodesk
  • 2025 to before 2025.1Affected
  • 2024 to before 2024.1.4Affected
  • 2023 to before 2023.1.6Affected
  • 2022 to before 2022.1.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.