CVE-2024-37007: Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products
Published Jun 25, 2024
·Updated
A maliciously crafted XB and XT file, when parsed in pskernel.DLL through Autodesk applications, can cause a use-after-free vulnerability. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
Affected Software
38 affected components
Autodesk AutoCAD
Autodesk AutoCAD-based products
Autodesk AutoCAD>=2022<2022.1.5
Autodesk AutoCAD>=2023<2023.1.6
Autodesk AutoCAD>=2024<2024.1.5
Autodesk AutoCAD>=2025<2025.1
Autodesk AutoCAD Architecture>=2022<2022.1.5
Autodesk AutoCAD Architecture>=2023<2023.1.6
Autodesk AutoCAD Architecture>=2024<2024.1.5
Autodesk AutoCAD Architecture>=2025<2025.1
Autodesk AutoCAD Electrical>=2022<2022.1.5
Autodesk AutoCAD Electrical>=2023<2023.1.6
Autodesk AutoCAD Electrical>=2024<2024.1.5
Autodesk AutoCAD Electrical>=2025<2025.1
Autodesk AutoCAD Map 3D>=2022<2022.1.5
Autodesk AutoCAD Map 3D>=2023<2023.1.6
Autodesk AutoCAD Map 3D>=2024<2024.1.5
Autodesk AutoCAD Map 3D>=2025<2025.1
Autodesk AutoCAD Mechanical>=2022<2022.1.5
Autodesk AutoCAD Mechanical>=2023<2023.1.6
Autodesk AutoCAD Mechanical>=2024<2024.1.5
Autodesk AutoCAD Mechanical>=2025<2025.1
Autodesk AutoCAD MEP>=2022<2022.1.5
Autodesk AutoCAD MEP>=2023<2023.1.6
Autodesk AutoCAD MEP>=2024<2024.1.5
Autodesk AutoCAD MEP>=2025<2025.1
Autodesk AutoCAD Plant 3D>=2022<2022.1.5
Autodesk AutoCAD Plant 3D>=2023<2023.1.6
Autodesk AutoCAD Plant 3D>=2024<2024.1.5
Autodesk AutoCAD Plant 3D>=2025<2025.1
Autodesk Civil 3D>=2022<2022.1.5
Autodesk Civil 3D>=2023<2023.1.6
Autodesk Civil 3D>=2024<2024.1.5
Autodesk Civil 3D>=2025<2025.1
Autodesk Advance Steel>=2022<2022.1.5
Autodesk Advance Steel>=2023<2023.1.6
Autodesk Advance Steel>=2024<2024.1.5
Autodesk Advance Steel>=2025<2025.1
Event History
Jun 25, 2024
CVE Published
via MITRE·03:35 AM
Data Sourced
via MITRE·03:35 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-37007?
CVE-2024-37007 is rated as a critical vulnerability due to its potential for code execution.
2
How do I fix CVE-2024-37007?
To fix CVE-2024-37007, ensure that you update your Autodesk applications to the latest patched version as recommended by Autodesk.
3
What software is affected by CVE-2024-37007?
CVE-2024-37007 affects Autodesk AutoCAD and other AutoCAD-based products.
4
What types of attacks can exploit CVE-2024-37007?
CVE-2024-37007 can be exploited through specially crafted X_B and X_T files that trigger a use-after-free condition.
5
Is CVE-2024-37007 a remote code execution vulnerability?
Yes, CVE-2024-37007 can lead to code execution in the current process if exploited.