CVE-2022-27865: High severity autodesk design review 2011 vulnerability

Published Jul 29, 2022

Updated

A maliciously crafted TGA or PCX file may be used to write beyond the allocated buffer through DesignReview.exe application while parsing TGA and PCX files. This vulnerability may be exploited to execute arbitrary code.

Affected Software

10 affected components

Autodesk Design Review=2011

Autodesk Design Review=2012

Autodesk Design Review=2013

Autodesk Design Review=2017

Autodesk Design Review=2018

Autodesk Design Review=2018-hotfix

Autodesk Design Review=2018-hotfix2

Autodesk Design Review=2018-hotfix3

Autodesk Design Review=2018-hotfix4

Autodesk Design Review=2018-hotfix5

Remediation

Patch Available

https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0009

Event History

Jul 29, 2022

CVE Published

via MITRE·07:01 PM

Data Sourced

via MITRE·07:01 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2022-27865.

What software is affected by this vulnerability?

Autodesk Design Review versions 2011, 2012, 2013, 2017, 2018, 2018-hotfix, 2018-hotfix2, 2018-hotfix3, 2018-hotfix4, and 2018-hotfix5 are affected by this vulnerability.

How can this vulnerability be exploited?

This vulnerability can be exploited by using a maliciously crafted TGA or PCX file to write beyond the allocated buffer through the DesignReview.exe application while parsing TGA and PCX files.

What is the severity of this vulnerability?

The severity of this vulnerability is high with a CVSS score of 7.8.

How can I fix this vulnerability?

To fix this vulnerability, it is recommended to update Autodesk Design Review to a version that is not affected by this vulnerability.