Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Autodesk AutoCAD: Malicious CAD File Can Crash or Steal Data

CVE-2024-8588 · published 2 years ago
Summary

A specially crafted CAD file can cause Autodesk AutoCAD to crash or allow an attacker to access sensitive information. This vulnerability affects users who open or import CAD files in AutoCAD. Update to the latest version to prevent potential data loss or security breaches.

What to do
  • Update autodesk autocad to version 2025.1.1 or later.
  • Update autodesk autocad_advance_steel to version 2025.1.1 or later.
  • Update autodesk autocad_architecture to version 2025.1.1 or later.
  • Update autodesk autocad_civil_3d to version 2025.1.1 or later.
  • Update autodesk autocad_electrical to version 2025.1.1 or later.
  • Update autodesk autocad_mechanical to version 2025.1.1 or later.
  • Update autodesk autocad_mep to version 2025.1.1 or later.
  • Update autodesk autocad_plant_3d to version 2025.1.1 or later.
Affected software
VendorProductAffected versions
autodesk autocad >= 2025, < 2025.1.1
cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*
autodesk autocad_advance_steel >= 2025, < 2025.1.1
cpe:2.3:a:autodesk:autocad_advance_steel:*:*:*:*:*:*:*:*
autodesk autocad_architecture >= 2025, < 2025.1.1
cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*
autodesk autocad_civil_3d >= 2025, < 2025.1.1
cpe:2.3:a:autodesk:autocad_civil_3d:*:*:*:*:*:*:*:*
autodesk autocad_electrical >= 2025, < 2025.1.1
cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*
autodesk autocad_mechanical >= 2025, < 2025.1.1
cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*
autodesk autocad_mep >= 2025, < 2025.1.1
cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*
autodesk autocad_plant_3d >= 2025, < 2025.1.1
cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*
Original advisory text
A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a c...
A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published29 Oct 2024
Updated29 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-8588 · NVD
Track software like this
Free during beta