Read the docs
TI-2021-17343 Aliases CVE-2021-40161GHSA-v4wc-276h-mcm2

Out-of-bounds write in Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD®…

Priority LOW 37CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through PDFTron earlier than 9.0.7 version.

Why it matters now

EPSS 0.01497 74th percentileScored 2026-11-07
Fix Fixed Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD® Architecture, AutoCAD® Electrical, AutoCAD® Map 3D, AutoCAD® Mechanical, AutoCAD® MEP, AutoCAD® Plant 3D, AutoCAD® LT, Autodesk® Civil 3D, AutoCAD® Mac, AutoCAD® LT for Mac: 9.0.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD® Architecture, AutoCAD® Electrical, AutoCAD® Map 3D, AutoCAD® Mechanical, AutoCAD® MEP, AutoCAD® Plant 3D, AutoCAD® LT, Autodesk® Civil 3D, AutoCAD® Mac, AutoCAD® LT for Macbefore 9.0.79.0.7Patch availableCNA
  • Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD® Architecture, AutoCAD® Electrical, AutoCAD® Map 3D, AutoCAD® Mechanical, AutoCAD® MEP, AutoCAD® Plant 3D, AutoCAD® LT, Autodesk® Civil 3D, AutoCAD® Mac, AutoCAD® LT for Mac Vendor— Affected before 9.0.7 Fixed in 9.0.7 Patch available CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*before 2020.2.5; 2021 to before 2021.1.6; 2022 to before 2022.1.2VulnerableAutodesk
cpe:2.3:a:autodesk:navisworks:*:*:*:*:*:*:*:*before 2019.6; 2020 to before 2020.4; 2021 to before 2021.3; 2022 to before 2022.2VulnerableAutodesk
cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2VulnerableAutodesk
cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2VulnerableAutodesk
  • cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:* Versions before 2020.2.5; 2021 to before 2021.1.6; 2022 to before 2022.1.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:navisworks:*:*:*:*:*:*:*:* Versions before 2019.6; 2020 to before 2020.4; 2021 to before 2021.3; 2022 to before 2022.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:* Versions before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:* Versions before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:* Versions before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:* Versions before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:* Versions before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:* Versions before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:* Versions before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:* Versions before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2 Vulnerable ·Autodesk
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2VulnerableAutodesk
cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2VulnerableAutodesk
cpe:2.3:a:autodesk:autocad:*:*:*:*:*:macos:*:*after 2022, before 2022.2VulnerableAutodesk
cpe:2.3:a:autodesk:autocad:2020:*:*:*:*:macos:*:*2020VulnerableAutodesk
cpe:2.3:a:autodesk:autocad:2021:*:*:*:*:macos:*:*2021VulnerableAutodesk
cpe:2.3:a:autodesk:autocad:2022:*:*:*:*:macos:*:*2022VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:macos:*:*2022 to before 2022.2VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_lt:2020:*:*:*:*:macos:*:*2020VulnerableAutodesk
cpe:2.3:a:autodesk:autocad_lt:2021:*:*:*:*:macos:*:*2021VulnerableAutodesk
cpe:2.3:a:autodesk:design_review:2018:-:*:*:*:*:*:*2018VulnerableAutodesk
cpe:2.3:a:autodesk:design_review:2018:hotfix:*:*:*:*:*:*2018 hotfixVulnerableAutodesk
cpe:2.3:a:autodesk:design_review:2018:hotfix2:*:*:*:*:*:*2018 hotfix2VulnerableAutodesk
cpe:2.3:a:autodesk:design_review:2018:hotfix3:*:*:*:*:*:*2018 hotfix3VulnerableAutodesk
cpe:2.3:a:autodesk:design_review:2018:hotfix4:*:*:*:*:*:*2018 hotfix4VulnerableAutodesk
  • cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:* Versions before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:* Versions before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad:*:*:*:*:*:macos:*:* Versions after 2022, before 2022.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad:2020:*:*:*:*:macos:*:* Versions 2020 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad:2021:*:*:*:*:macos:*:* Versions 2021 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad:2022:*:*:*:*:macos:*:* Versions 2022 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:macos:*:* Versions 2022 to before 2022.2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_lt:2020:*:*:*:*:macos:*:* Versions 2020 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:autocad_lt:2021:*:*:*:*:macos:*:* Versions 2021 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:design_review:2018:-:*:*:*:*:*:* Versions 2018 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:design_review:2018:hotfix:*:*:*:*:*:* Versions 2018 hotfix Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:design_review:2018:hotfix2:*:*:*:*:*:* Versions 2018 hotfix2 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:design_review:2018:hotfix3:*:*:*:*:*:* Versions 2018 hotfix3 Vulnerable ·Autodesk
  • cpe:2.3:a:autodesk:design_review:2018:hotfix4:*:*:*:*:*:* Versions 2018 hotfix4 Vulnerable ·Autodesk

Remediation

  • Fix · CNA Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD® Architecture, AutoCAD® Electrical, AutoCAD® Map 3D, AutoCAD® Mechanical, AutoCAD® MEP, AutoCAD® Plant 3D, AutoCAD® LT, Autodesk® Civil 3D, AutoCAD® Mac, AutoCAD® LT for Mac Fixed in 9.0.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-40161
  2. 2026-10-03 Alias added: GHSA-v4wc-276h-mcm2

References

Patch 1

  • TI-2021-17340 Out-of-bounds read in Inventor CVSS 3.1HIGH 7.8
  • TI-2021-17341 Information disclosure in Inventor CVSS 3.1HIGH 7.8
  • TI-2022-09360 Out-of-bounds write in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD… CVSS 3.1HIGH 7.8
  • TI-2024-15258 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software CVSS 3.1HIGH 7.8
  • TI-2021-08615 Improper handling of exceptional conditions in Autodesk Advanced Steel, Civil 3D… CVSS 3.1HIGH 7.8
  • TI-2019-05247 Uncontrolled search path in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT… CVSS 3.0HIGH 7.8
See all 94 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences