CVE-2022-27866
First published: Fri Jul 29 2022(Updated: )
A maliciously crafted TIFF file when consumed through DesignReview.exe application can be forced to read beyond allocated boundaries when parsing the TIFF file. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Credit: psirt@autodesk.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Autodesk Design Review | =2011 | |
| Autodesk Design Review | =2012 | |
| Autodesk Design Review | =2013 | |
| Autodesk Design Review | =2017 | |
| Autodesk Design Review | =2018 | |
| Autodesk Design Review | =2018-hotfix | |
| Autodesk Design Review | =2018-hotfix2 | |
| Autodesk Design Review | =2018-hotfix3 | |
| Autodesk Design Review | =2018-hotfix4 | |
| Autodesk Design Review | =2018-hotfix5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-27866?
CVE-2022-27866 is a vulnerability in Autodesk Design Review where a maliciously crafted TIFF file can be forced to read beyond allocated boundaries, potentially leading to code execution.
How does CVE-2022-27866 affect Autodesk Design Review?
CVE-2022-27866 affects Autodesk Design Review versions 2011, 2012, 2013, 2017, 2018, and hotfix versions 2018-hotfix, 2018-hotfix2, 2018-hotfix3, and 2018-hotfix4. It allows a malicious TIFF file to exploit the vulnerability.
What is the severity of CVE-2022-27866?
CVE-2022-27866 has a severity rating of 7.8 (high).
How can I fix CVE-2022-27866?
To fix CVE-2022-27866, update Autodesk Design Review to the latest version or apply the available hotfixes provided by Autodesk.
Where can I find more information about CVE-2022-27866?
You can find more information about CVE-2022-27866 in the Autodesk Security Advisory ADSSA-2022-0009 at https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0009.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/tags
- agent/event
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/autodesk
- canonical/autodesk design review
- version/autodesk design review/2011
- version/autodesk design review/2012
- version/autodesk design review/2013
- version/autodesk design review/2017
- version/autodesk design review/2018
- version/autodesk design review/2018-hotfix
- version/autodesk design review/2018-hotfix2
- version/autodesk design review/2018-hotfix3
- version/autodesk design review/2018-hotfix4
- version/autodesk design review/2018-hotfix5