CVE-2024-7674

DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software

State: Published
Severity: 7.8 High
Published: Sep 30, 2024
Updated: Aug 26, 2025
Reserved: Aug 10, 2024

Description

A maliciously crafted DWFX file, when parsed in dwfcore.dll through Autodesk Navisworks, can force a Heap-based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash or execute arbitrary code in the context of the current process.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	autodesk

Weaknesses

CWE-122 Heap-based Buffer Overflow

Affected Products

Product	Versions
Navisworks FreedomAutodesk	2025 to before 2025.3Affected 2024 to before 2024.3Affected 2023 to before 2023.5Affected 2022 to before 2022.6Affected
Navisworks SimulateAutodesk	2025 to before 2025.3Affected 2024 to before 2024.3Affected 2023 to before 2023.5Affected 2022 to before 2022.6Affected
Navisworks ManageAutodesk	2025 to before 2025.3Affected 2024 to before 2024.3Affected 2023 to before 2023.5Affected 2022 to before 2022.6Affected

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0015

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.