An exploitable heap overflow vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk…

published 2019-04-09 7y ago modified 2026-06-17 4mo ago also EUVD-2019-16900

cvss: 7.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.6%; EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits: 0; none known

An exploitable heap overflow vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file may cause a heap overflow, resulting in code execution.

Is CVE-2019-7358 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

1.64% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Autodesk Autodesk AutoCAD LT
Autodesk Autodesk Civil 3D
Autodesk Autodesk Advance Steel
Autodesk Autodesk AutoCAD
Autodesk Autodesk AutoCAD Architecture
Autodesk Autodesk AutoCAD Electrical
Autodesk Autodesk AutoCAD Map 3D
Autodesk Autodesk AutoCAD Mechanical
Autodesk Autodesk AutoCAD MEP
Autodesk Autodesk AutoCAD P&ID
Autodesk Autodesk AutoCAD Plant 3D

Classification

Weakness

CWE-787 Out-of-bounds Write

References

autodesk.com /trust/security-advisories/adsk-sa-2019-0001
vendor-advisory

Sources

CVE List CVE-2019-7358
NVD CVE-2019-7358

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.