CVE-2024-8591

A maliciously crafted 3DM file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Heap-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://autodesk.com/trust/security-advisories/adsk-sa-2024-0019

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:autodesk:autocad::::::::
	cpe:2.3:a:autodesk:autocad_advance_steel::::::::
	cpe:2.3:a:autodesk:autocad_architecture::::::::
	cpe:2.3:a:autodesk:autocad_civil_3d::::::::
	cpe:2.3:a:autodesk:autocad_electrical::::::::
	cpe:2.3:a:autodesk:autocad_mechanical::::::::
	cpe:2.3:a:autodesk:autocad_mep::::::::
	cpe:2.3:a:autodesk:autocad_plant_3d::::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

03 Feb 2025, 17:15

Type	Values Removed	Values Added
References	~~{'url': 'https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019', 'tags': ['Vendor Advisory'], 'source': 'psirt@autodesk.com'}~~	() https://autodesk.com/trust/security-advisories/adsk-sa-2024-0019 -

01 Nov 2024, 16:18

Type	Values Removed	Values Added
CWE		CWE-787
References	~~() https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019 -~~	() https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019 - Vendor Advisory
CPE		cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:autodesk:autocad_electrical:::::::: cpe:2.3:a:autodesk:autocad:::::::: cpe:2.3:a:autodesk:autocad_civil_3d:::::::: cpe:2.3:a:autodesk:autocad_architecture:::::::: cpe:2.3:a:autodesk:autocad_mep:::::::: cpe:2.3:a:autodesk:autocad_plant_3d:::::::: cpe:2.3:a:autodesk:autocad_advance_steel:::::::: cpe:2.3:a:autodesk:autocad_mechanical::::::::
First Time		Autodesk autocad Plant 3d Autodesk autocad Advance Steel Autodesk autocad Autodesk autocad Architecture Autodesk autocad Civil 3d Autodesk autocad Mechanical Autodesk autocad Mep Autodesk Autodesk autocad Electrical Microsoft Microsoft windows

01 Nov 2024, 12:57

Type	Values Removed	Values Added
Summary		(es) Un archivo 3DM creado con fines malintencionados, cuando se analiza en AcTranslators.exe a través de Autodesk AutoCAD, puede provocar una vulnerabilidad de desbordamiento de búfer de almacenamiento dinámico. Un actor malintencionado puede aprovechar esta vulnerabilidad para provocar un bloqueo, escribir datos confidenciales o ejecutar código arbitrario en el contexto del proceso actual.

29 Oct 2024, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-29 22:15

Updated : 2025-02-03 17:15

NVD link : CVE-2024-8591

Mitre link : CVE-2024-8591

CVE.ORG link : CVE-2024-8591

JSON object : View

Products Affected

autodesk

autocad_civil_3d
autocad_architecture
autocad_mep
autocad
autocad_advance_steel
autocad_mechanical
autocad_plant_3d
autocad_electrical

microsoft

windows

CWE

CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2024-8591", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@autodesk.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-10-29T22:15:06.537", "references": [{"url": "https://autodesk.com/trust/security-advisories/adsk-sa-2024-0019", "source": "psirt@autodesk.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@autodesk.com", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted 3DM file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Heap-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process."}, {"lang": "es", "value": " Un archivo 3DM creado con fines malintencionados, cuando se analiza en AcTranslators.exe a trav\u00e9s de Autodesk AutoCAD, puede provocar una vulnerabilidad de desbordamiento de b\u00fafer de almacenamiento din\u00e1mico. Un actor malintencionado puede aprovechar esta vulnerabilidad para provocar un bloqueo, escribir datos confidenciales o ejecutar c\u00f3digo arbitrario en el contexto del proceso actual."}], "lastModified": "2025-02-03T17:15:23.577", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8108219C-2977-47DF-8818-F7360E0AEA31", "versionEndExcluding": "2025.1.1", "versionStartIncluding": "2025"}, {"criteria": "cpe:2.3:a:autodesk:autocad_advance_steel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "583DCDB2-2170-4A06-B532-31886E2F1B12", "versionEndExcluding": "2025.1.1", "versionStartIncluding": "2025"}, {"criteria": "cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A993F4D4-A2BA-42F7-B840-36BCCE6FF725", "versionEndExcluding": "2025.1.1", "versionStartIncluding": "2025"}, {"criteria": "cpe:2.3:a:autodesk:autocad_civil_3d:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4C616A7-A68D-42C5-88EB-9A6FE2C53116", "versionEndExcluding": "2025.1.1", "versionStartIncluding": "2025"}, {"criteria": "cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F08AC00E-D022-401C-9A0F-55C5943591C8", "versionEndExcluding": "2025.1.1", "versionStartIncluding": "2025"}, {"criteria": "cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA51DA68-070A-40F6-BF50-DBC31DCDD224", "versionEndExcluding": "2025.1.1", "versionStartIncluding": "2025"}, {"criteria": "cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DF22F44-1D3F-4F18-9835-8E0AE817377C", "versionEndExcluding": "2025.1.1", "versionStartIncluding": "2025"}, {"criteria": "cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1E9CD44-2AD4-4145-9816-60D0BD468D37", "versionEndExcluding": "2025.1.1", "versionStartIncluding": "2025"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@autodesk.com"}

7.8 /10