CVE-2021-27042: High severity Autodesk Advance Steel vulnerability
A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. The vulnerability exists because the application fails to handle a crafted DWG file, which causes an unhandled exception. An attacker can leverage this vulnerability to execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-27042.
What is the severity of CVE-2021-27042?
The severity of CVE-2021-27042 is high with a CVSS score of 7.8.
Which software products are affected by CVE-2021-27042?
The software products affected by CVE-2021-27042 include Autodesk Advance Steel (versions 2019 - 2022), Autodesk Autocad (versions 2019 - 2022), Autodesk AutoCAD Architecture (versions 2019 - 2022), Autodesk AutoCAD Electrical (versions 2019 - 2022), Autodesk Autocad Lt (versions 2019 - 2022), Autodesk AutoCAD Map 3D (versions 2019 - 2022), Autodesk AutoCAD Mechanical (versions 2019 - 2022), Autodesk AutoCAD MEP (versions 2019 - 2022), Autodesk AutoCAD Plant 3D (versions 2019 - 2022), and Autodesk Civil 3D (versions 2019 - 2022).
How does the vulnerability in CVE-2021-27042 work?
The vulnerability in CVE-2021-27042 allows a maliciously crafted DWG file to write beyond the allocated buffer while parsing DWG files, leading to an unhandled exception and potential execution of arbitrary code.
Is there a fix available for CVE-2021-27042?
Yes, Autodesk has released a security advisory with a fix for CVE-2021-27042. To protect against this vulnerability, users should update their affected software to the latest available version.