Skip to content
OpenAdvisories
High · 7.8 CVE-2024-23136 EUVD-2024-20655GHSA-rxxm-q32v-2mc5

Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software

Published Feb 22, 2024 · Updated Aug 26, 2025 · Assigned by autodesk

Vendor: Autodesk Product: Advance Steel Product: AutoCAD Product: AutoCAD Architecture Product: AutoCAD Electrical Product: AutoCAD MAP 3D Product: AutoCAD Mechanical Product: AutoCAD MEP Product: AutoCAD Plant 3D Product: Civil 3D

Description

A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

Affected products

VendorProductAffectedFixed
Autodesk AutoCAD 2025 – < 2025.0.1, 2024 – < 2024.1.3, 2023 – < 2023.1.5, 2022 – < 2022.1.4, 2021 – < 2021.1.4 2025.0.1
Autodesk AutoCAD Architecture 2025 – < 2025.0.1, 2024 – < 2024.1.3, 2023 – < 2023.1.5, 2022 – < 2022.1.4, 2021 – < 2021.1.4 2025.0.1
Autodesk AutoCAD Electrical 2025 – < 2025.0.1, 2024 – < 2024.1.3, 2023 – < 2023.1.5, 2022 – < 2022.1.4, 2021 – < 2021.1.4 2025.0.1
Autodesk AutoCAD Mechanical 2025 – < 2025.0.1, 2024 – < 2024.1.3, 2023 – < 2023.1.5, 2022 – < 2022.1.4, 2021 – < 2021.1.4 2025.0.1
Autodesk AutoCAD MEP 2025 – < 2025.0.1, 2024 – < 2024.1.3, 2023 – < 2023.1.5, 2022 – < 2022.1.4, 2021 – < 2021.1.4 2025.0.1
Autodesk AutoCAD Plant 3D 2025 – < 2025.0.1, 2024 – < 2024.1.3, 2023 – < 2023.1.5, 2022 – < 2022.1.4, 2021 – < 2021.1.4 2025.0.1
Autodesk Civil 3D 2025 – < 2025.0.1, 2024 – < 2024.1.3, 2023 – < 2023.1.5, 2022 – < 2022.1.4, 2021 – < 2021.1.4 2025.0.1
Autodesk Advance Steel 2025 – < 2025.0.1, 2024 – < 2024.1.3, 2023 – < 2023.1.5, 2022 – < 2022.1.4, 2021 – < 2021.1.4 2025.0.1
Autodesk AutoCAD MAP 3D 2025 – < 2025.0.1, 2024 – < 2024.1.3, 2023 – < 2023.1.5, 2022 – < 2022.1.4, 2021 – < 2021.1.4 2025.0.1

Advisories 1

References