CVE-2023-29074
First published: Thu Nov 23 2023(Updated: )
A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Credit: psirt@autodesk.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Autodesk Autocad | <2024.1 | |
| Autodesk Autocad | >=2023.0.0<2023.1.4 | |
| Autodesk Autocad | >=2024.0.0<2024.1.1 | |
| Autodesk Autocad Advance Steel | <2023.1.4 | |
| Autodesk Autocad Advance Steel | >=2024.0.0<2024.1.1 | |
| Autodesk AutoCAD Architecture | <2023.1.4 | |
| Autodesk AutoCAD Architecture | >=2024.0.0<2024.1.1 | |
| Autodesk Autocad Civil 3d | <2023.1.4 | |
| Autodesk Autocad Civil 3d | >=2024.0.0<2024.1.1 | |
| Autodesk AutoCAD Electrical | <2023.1.4 | |
| Autodesk AutoCAD Electrical | >=2024.0.0<2024.1.1 | |
| Autodesk Autocad Lt | <2023.1.4 | |
| Autodesk Autocad Lt | <2024.1 | |
| Autodesk Autocad Lt | >=2024.0.0<2024.1.1 | |
| Autodesk AutoCAD Map 3D | <2023.1.4 | |
| Autodesk AutoCAD Map 3D | >=2024.0.0<2024.1.1 | |
| Autodesk AutoCAD Mechanical | <2023.1.4 | |
| Autodesk AutoCAD Mechanical | >=2024.0.0<2024.1.1 | |
| Autodesk AutoCAD MEP | <2023.1.4 | |
| Autodesk AutoCAD MEP | >=2024.0.0<2024.1.1 | |
| Autodesk AutoCAD Plant 3D | <2023.1.4 | |
| Autodesk AutoCAD Plant 3D | >=2024.0.0<2024.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-29074?
CVE-2023-29074 is a vulnerability in Autodesk AutoCAD 2024 and 2023 that allows a maliciously crafted CATPART file to cause an Out-Of-Bounds Write.
What is the severity of CVE-2023-29074?
The severity of CVE-2023-29074 is critical, with a CVSS score of 9.8.
Which software versions are affected by CVE-2023-29074?
Autodesk AutoCAD versions 2024 and 2023, as well as related products such as Autodesk AutoCAD Advance Steel, AutoCAD Architecture, AutoCAD Civil 3D, AutoCAD Electrical, AutoCAD LT, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, and AutoCAD Plant 3D are affected.
How can CVE-2023-29074 be exploited?
CVE-2023-29074 can be exploited by a malicious actor using a specially crafted CATPART file to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Where can I find more information about CVE-2023-29074?
More information about CVE-2023-29074 can be found in Autodesk's security advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018.
- collector/mitre-cve
- collector/nvd-api
- vendor/autodesk
- canonical/autodesk autocad
- version/autodesk autocad/2023.0.0
- version/autodesk autocad/2024.0.0
- canonical/autodesk autocad advance steel
- version/autodesk autocad advance steel/2024.0.0
- canonical/autodesk autocad architecture
- version/autodesk autocad architecture/2024.0.0
- canonical/autodesk autocad civil 3d
- version/autodesk autocad civil 3d/2024.0.0
- canonical/autodesk autocad electrical
- version/autodesk autocad electrical/2024.0.0
- canonical/autodesk autocad lt
- version/autodesk autocad lt/2024.0.0
- canonical/autodesk autocad map 3d
- version/autodesk autocad map 3d/2024.0.0
- canonical/autodesk autocad mechanical
- version/autodesk autocad mechanical/2024.0.0
- canonical/autodesk autocad mep
- version/autodesk autocad mep/2024.0.0
- canonical/autodesk autocad plant 3d
- version/autodesk autocad plant 3d/2024.0.0