TI-2022-09367 Aliases CVE-2022-25795 GHSA-h4xh-c6fv-xjv7

Improper handling of exceptional conditions in Revit, Navisworks, Autodesk® Advance…

LOW 38CWE-755Published 2022-04-13 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A Memory Corruption Vulnerability in Autodesk TrueView 2022 and 2021 may lead to remote code execution through maliciously crafted DWG files.

Why it matters now

EPSS 0.01944 80th percentileScored 2026-11-07

Fix Fixed Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD® Architecture, AutoCAD® Electrical, AutoCAD® Map 3D, AutoCAD® Mechanical, AutoCAD® MEP, AutoCAD® Plant 3D, AutoCAD® LT, Autodesk® Civil 3D, AutoCAD® Mac, AutoCAD® LT for Mac: 9.0.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD® Architecture, AutoCAD® Electrical, AutoCAD® Map 3D, AutoCAD® Mechanical, AutoCAD® MEP, AutoCAD® Plant 3D, AutoCAD® LT, Autodesk® Civil 3D, AutoCAD® Mac, AutoCAD® LT for Mac	before 9.0.7	9.0.7	Patch available	CNA

Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD® Architecture, AutoCAD® Electrical, AutoCAD® Map 3D, AutoCAD® Mechanical, AutoCAD® MEP, AutoCAD® Plant 3D, AutoCAD® LT, Autodesk® Civil 3D, AutoCAD® Mac, AutoCAD® LT for Mac Vendor— Affected before 9.0.7 Fixed in 9.0.7 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:autodesk:autocad::::::::	before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2	Vulnerable	Autodesk

cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:* Versions before 2019.1.4; 2020 to before 2020.1.5; 2021 to before 2021.1.2; 2022 to before 2022.1.2 Vulnerable ·Autodesk

Remediation

Fix · CNA Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD® Architecture, AutoCAD® Electrical, AutoCAD® Map 3D, AutoCAD® Mechanical, AutoCAD® MEP, AutoCAD® Plant 3D, AutoCAD® LT, Autodesk® Civil 3D, AutoCAD® Mac, AutoCAD® LT for Mac Fixed in 9.0.7

Timeline

2026-10-02 Threatist record created from CVE-2022-25795
2026-10-03 Alias added: GHSA-h4xh-c6fv-xjv7

References

Advisory 1

https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007

Other 1

https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0010%3B

TI-2023-13523 Memory corruption in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
TI-2023-13522 Out-of-bounds write in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
TI-2023-13521 Out-of-bounds write in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
TI-2023-13520 Heap-based buffer overflow in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
TI-2021-17340 Out-of-bounds read in Inventor CVSS 3.1HIGH 7.8
TI-2021-17341 Information disclosure in Inventor CVSS 3.1HIGH 7.8

See all 167 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences