CVE-2024-23136 json
Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
published 2y ago modified 4mo ago also EUVD-2024-20655
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
Patch / fix
- Autodesk AutoCAD 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD Architecture 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD Electrical 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD Mechanical 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD MEP 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD Plant 3D 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk Civil 3D 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk Advance Steel 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- Autodesk AutoCAD MAP 3D 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- autodesk autocad_advance_steel 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
- autodesk autocad_civil_3d 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
Is CVE-2024-23136 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2y ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
- Autodesk AutoCAD
- Autodesk AutoCAD Architecture
- Autodesk AutoCAD Electrical
- Autodesk AutoCAD Mechanical
- Autodesk AutoCAD MEP
- Autodesk AutoCAD Plant 3D
- Autodesk Civil 3D
- Autodesk Advance Steel
- Autodesk AutoCAD MAP 3D
- autodesk autocad_advance_steel
- autodesk autocad_civil_3d
Classification
- Weakness
-
- CWE-822 Untrusted Pointer Dereference
References
-
autodesk.com
/trust/security-advisories/adsk-sa-2024-0002
vendor-advisory
-
autodesk.com
/trust/security-advisories/adsk-sa-2024-0004
vendor-advisory
Sources
- CVE List CVE-2024-23136
- NVD CVE-2024-23136
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.