CVE-2024-7992

Autodesk AutoCAD DWG Stack-Based Buffer Overflow Code Execution Vulnerability

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force a Stack-based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Un archivo DWG creado con fines malintencionados, cuando se analiza a través de Autodesk AutoCAD y ciertos productos basados en AutoCAD, puede provocar un desbordamiento de búfer en la región stack de la memoria . Un actor malintencionado puede aprovechar esta vulnerabilidad para provocar un bloqueo, leer datos confidenciales o ejecutar código arbitrario en el contexto del proceso actual.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2024-08-19 CVE Reserved
2024-10-29 CVE Published
2025-05-14 CVE Updated
2025-06-04 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-121: Stack-based Buffer Overflow

CAPEC

CAPEC-100: Overflow Buffers

References (2)

URL	Tag	Source
https://autodesk.com/trust/security-advisories/adsk-sa-2024-0021
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Autodesk Search vendor "Autodesk"		Advance Steel Search vendor "Autodesk" for product "Advance Steel"				*		-		Affected
Autodesk Search vendor "Autodesk"		Autocad Search vendor "Autodesk" for product "Autocad"				*		-		Affected
Autodesk Search vendor "Autodesk"		Autocad Advance Steel Search vendor "Autodesk" for product "Autocad Advance Steel"				*		-		Affected
Autodesk Search vendor "Autodesk"		Autocad Architecture Search vendor "Autodesk" for product "Autocad Architecture"				*		-		Affected
Autodesk Search vendor "Autodesk"		Autocad Civil 3d Search vendor "Autodesk" for product "Autocad Civil 3d"				*		-		Affected
Autodesk Search vendor "Autodesk"		Autocad Electrical Search vendor "Autodesk" for product "Autocad Electrical"				*		-		Affected
Autodesk Search vendor "Autodesk"		Autocad Lt Search vendor "Autodesk" for product "Autocad Lt"				*		-		Affected
Autodesk Search vendor "Autodesk"		Autocad Mechanical Search vendor "Autodesk" for product "Autocad Mechanical"				*		-		Affected
Autodesk Search vendor "Autodesk"		Autocad Mep Search vendor "Autodesk" for product "Autocad Mep"				*		-		Affected
Autodesk Search vendor "Autodesk"		Autocad Plant 3d Search vendor "Autodesk" for product "Autocad Plant 3d"				*		-		Affected
Autodesk Search vendor "Autodesk"		Civil 3d Search vendor "Autodesk" for product "Civil 3d"				*		-		Affected
Autodesk Search vendor "Autodesk"		Dwg Trueview Search vendor "Autodesk" for product "Dwg Trueview"				*		-		Affected
Autodesk Search vendor "Autodesk"		Infrastructure Parts Editor Search vendor "Autodesk" for product "Infrastructure Parts Editor"				*		-		Affected
Autodesk Search vendor "Autodesk"		Inventor Search vendor "Autodesk" for product "Inventor"				*		-		Affected
Autodesk Search vendor "Autodesk"		Navisworks Search vendor "Autodesk" for product "Navisworks"				*		-		Affected
Autodesk Search vendor "Autodesk"		Revit Search vendor "Autodesk" for product "Revit"				*		-		Affected