CVE-2024-8598: Autodesk AutoCAD ACTranslators STEP File Parsing Memory Corruption Code Execution Vulnerability
First published: Tue Oct 29 2024(Updated: )
A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
Credit: psirt@autodesk.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Any of | ||
| AutoCAD | >=2025<2025.1.1 | |
| Autodesk AutoCAD Advance Steel | >=2025<2025.1.1 | |
| AutoCAD | >=2025<2025.1.1 | |
| Autodesk Civil 3D | >=2025<2025.1.1 | |
| AutoCAD | >=2025<2025.1.1 | |
| AutoCAD | >=2025<2025.1.1 | |
| AutoCAD | >=2025<2025.1.1 | |
| AutoCAD | >=2025<2025.1.1 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-8598?
CVE-2024-8598 is considered a critical severity vulnerability due to its potential to cause memory corruption and execute arbitrary code.
How do I fix CVE-2024-8598?
To fix CVE-2024-8598, users should update their Autodesk AutoCAD software to the latest version that addresses this vulnerability.
What impact does CVE-2024-8598 have on affected software?
CVE-2024-8598 can lead to application crashes, data leaks, or the execution of arbitrary code, posing significant risks to user data and system integrity.
What versions of Autodesk software are affected by CVE-2024-8598?
CVE-2024-8598 affects versions of Autodesk AutoCAD from 2025 to 2025.1.1 across multiple products including Civil 3D, Electrical, and Mechanical.
Can exploitation of CVE-2024-8598 be performed remotely?
Yes, exploitation of CVE-2024-8598 can potentially be performed remotely if a malicious STP file is delivered and opened by the user.
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/weakness
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/autodesk
- canonical/autocad
- version/autocad/2025
- canonical/autodesk autocad advance steel
- version/autodesk autocad advance steel/2025
- canonical/autodesk civil 3d
- version/autodesk civil 3d/2025
- vendor/microsoft
- canonical/microsoft windows