CVE-2022-33886 json
A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2…
published 4y ago modified 4mo ago also EUVD-2022-36924
- cvss
- 7.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2022, 2021, 2020, and Maya 2023 and 2022. The vulnerability exists because the application fails to handle crafted MODEL and SLDPRT files, which causes an unhandled exception. A malicious actor could leverage this vulnerability to execute arbitrary code.
Patch / fix
- autodesk autocad 2022.1.3, 2023.1.1
- autodesk autocad_advance_steel 2022.1.3, 2023.1.1
- autodesk autocad_architecture 2022.1.3, 2023.1.1
- autodesk autocad_civil_3d 2022.1.3, 2023.1.1
- autodesk autocad_electrical 2022.1.3, 2023.1.1
- autodesk autocad_lt 2022.1.3, 2023.1.1
- autodesk autocad_map_3d 2022.1.3, 2023.1.1
- autodesk autocad_mechanical 2022.1.3, 2023.1.1
- autodesk autocad_mep 2022.1.3, 2023.1.1
- autodesk autocad_plant_3d 2022.1.3, 2023.1.1
Is CVE-2022-33886 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
1.01% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
- n/a Autodesk Maya
Classification
- Weakness
-
- CWE-755 Improper Handling of Exceptional Conditions
References
-
autodesk.com
/trust/security-advisories/adsk-sa-2022-0020
vendor-advisory
Sources
- CVE List CVE-2022-33886
- NVD CVE-2022-33886
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.