Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-40166: A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by...

CVE-2021-40166 · published 4 years ago

Summary

A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by attackers to execute arbitrary code.

What to do

Update autodesk fusion to version 2.0.11405 or later.

Affected software

Vendor	Product	Affected versions
autodesk	autocad	>= 2019, < 2019.1.4 >= 2020, < 2020.1.5 >= 2021, < 2021.1.2 >= 2022, < 2022.1.2 `cpe:2.3:a:autodesk:autocad::::::::`
autodesk	autocad_advance_steel	>= 2019, < 2019.1.4 >= 2020, < 2020.1.5 >= 2021, < 2021.1.2 >= 2022, < 2022.1.2 `cpe:2.3:a:autodesk:autocad_advance_steel::::::::`
autodesk	autocad_architecture	>= 2019, < 2019.1.4 >= 2020, < 2020.1.5 >= 2021, < 2021.1.2 >= 2022, < 2022.1.2 `cpe:2.3:a:autodesk:autocad_architecture::::::::`
autodesk	autocad_civil_3d	>= 2019, < 2019.1.4 >= 2020, < 2020.1.5 >= 2021, < 2021.1.2 >= 2022, < 2022.1.2 `cpe:2.3:a:autodesk:autocad_civil_3d::::::::`
autodesk	autocad_electrical	>= 2019, < 2019.1.4 >= 2020, < 2020.1.5 >= 2021, < 2021.1.2 >= 2022, < 2022.1.2 `cpe:2.3:a:autodesk:autocad_electrical::::::::`
autodesk	autocad_lt	>= 2019, < 2019.1.4 >= 2020, < 2020.1.5 >= 2020, < 2020.3.2 >= 2021, < 2021.1.2 >= 2021, < 2021.2.2 >= 2022, < 2022.1.2 >= 2022, < 2022.2.2 `cpe:2.3:a:autodesk:autocad_lt::::::::`
autodesk	autocad_map_3d	>= 2019, < 2019.1.4 >= 2020, < 2020.1.5 >= 2021, < 2021.1.2 >= 2022, < 2022.1.2 `cpe:2.3:a:autodesk:autocad_map_3d::::::::`
autodesk	autocad_mechanical	>= 2019, < 2019.1.4 >= 2020, < 2020.1.5 >= 2021, < 2021.1.2 >= 2022, < 2022.1.2 `cpe:2.3:a:autodesk:autocad_mechanical::::::::`
autodesk	autocad_mep	>= 2019, < 2019.1.4 >= 2020, < 2020.1.5 >= 2021, < 2021.1.2 >= 2022, < 2022.1.2 `cpe:2.3:a:autodesk:autocad_mep::::::::`
autodesk	autocad_plant_3d	>= 2019, < 2019.1.4 >= 2020, < 2020.1.5 >= 2021, < 2021.1.2 >= 2022, < 2022.1.2 `cpe:2.3:a:autodesk:autocad_plant_3d::::::::`
autodesk	design_review	2018 `cpe:2.3:a:autodesk:design_review:2018:-::::::`
autodesk	dwg_trueview	>= 2019, < 2019.1.4 >= 2020, < 2020.1.5 >= 2021, < 2021.1.2 >= 2022, < 2022.1.1 `cpe:2.3:a:autodesk:dwg_trueview::::::::`
autodesk	fusion	>= 2.0.10356, < 2.0.11405 `cpe:2.3:a:autodesk:fusion::::::::`
autodesk	infrastructure_parts_editor	>= 2019, < 2019.2.2 >= 2020, < 2020.0.2 2021 2022 `cpe:2.3:a:autodesk:infrastructure_parts_editor::::::::`
autodesk	infraworks	>= 2019, < 2019.3 >= 2020, < 2020.2 >= 2021, < 2021.2 2019.3 2020.2 2021.2 2022.0 2022.1 `cpe:2.3:a:autodesk:infraworks::::::::`
autodesk	inventor	>= 2019, < 2019.6 >= 2020, < 2020.5 >= 2021, < 2021.4 >= 2022, < 2022.2 `cpe:2.3:a:autodesk:inventor::::::::`
autodesk	navisworks	>= 2019, < 2019.7 >= 2020, < 2020.5 >= 2021, < 2021.4 >= 2022, < 2022.2 `cpe:2.3:a:autodesk:navisworks::::::::`
autodesk	revit	>= 2019, < 2019.2.4 >= 2020, < 2020.2.6 >= 2021, < 2021.1.5 2022 `cpe:2.3:a:autodesk:revit::::::::`
autodesk	storm_and_sanitary_analysis	>= 2020, < 2020.3.1 >= 2021, < 2021.3.1 2019 2022 `cpe:2.3:a:autodesk:storm_and_sanitary_analysis::::::::`

Original advisory text

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published7 Oct 2022

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2021-40166 · NVD

Track software like this

Free during beta