This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Autodesk AutoCAD fixes 22 vulnerabilities
Autodesk fixes a vulnerability in AutoCAD 2024 with version 2024.1.6 and 21 vulnerabilities in AutoCAD 2025 with version 2025.1.1. A detailed description of the individual vulnerabilities can be found at [1][2][3].
An unauthenticated local attacker is able, when parsing a specially crafted CATPART file, to corrupt data in memory and potentially crash the application, write data without authorization or execute code. This vulnerability affects AutoCAD 2024 [1].
The vulnerability is present in product:
- AutoCAD; >=2024, <2024.1.6
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-8592 at cve.org, NVD
- CWE-787: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') at cwe.mitre.org
The vulnerability was publicly disclosed 29. 10. 2024.
An unauthenticated local attacker is able, when parsing specially crafted files (3DM, MODEL), through use-after-free vulnerabilities, to crash the application, write data without authorization or execute code. These vulnerabilities affect AutoCAD 2025 and some other products based on it [2].
The vulnerability is present in product:
- AutoCAD; >=2025, <2025.1.1
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-8590 at cve.org, NVD
- CVE-2024-8595 at cve.org, NVD
- CVE-2024-9826 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 29. 10. 2024.
An unauthenticated local attacker is able, when parsing a specially crafted DXF file, through access to an uninitialized variable, to crash the application, write data without authorization or execute code. This vulnerability affects AutoCAD 2025 and some other products based on it [3][2].
The vulnerability is present in product:
- AutoCAD; >=2025, <2025.1.1
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-8896 at cve.org, NVD
- CWE-908: Use of Uninitialized Resource at cwe.mitre.org
The vulnerability was publicly disclosed 29. 10. 2024.
An unauthenticated local attacker is able, when parsing specially crafted files (DWG, DXF, SLDPRT, 3DM, CATPART, MODEL, STEP, STP), through insufficient memory buffer boundary checks, to crash the application, read/write data without authorization or execute code. These vulnerabilities affect AutoCAD 2025 and some other products based on it [2][3].
The vulnerability is present in product:
- AutoCAD; >=2025, <2025.1.1
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-7991 at cve.org, NVD
- CVE-2024-7992 at cve.org, NVD
- CVE-2024-8587 at cve.org, NVD
- CVE-2024-8588 at cve.org, NVD
- CVE-2024-8589 at cve.org, NVD
- CVE-2024-8591 at cve.org, NVD
- CVE-2024-8593 at cve.org, NVD
- CVE-2024-8594 at cve.org, NVD
- CVE-2024-8596 at cve.org, NVD
- CVE-2024-8597 at cve.org, NVD
- CVE-2024-8598 at cve.org, NVD
- CVE-2024-8599 at cve.org, NVD
- CVE-2024-8560 at cve.org, NVD
- CVE-2024-9489 at cve.org, NVD
- CVE-2024-9827 at cve.org, NVD
- CVE-2024-9996 at cve.org, NVD
- CVE-2024-9997 at cve.org, NVD
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org
The vulnerability was publicly disclosed 29. 10. 2024.
Links
By CESNET, z.s.p.o. Michaela Ručková on 6. 11. 2024.