TI-2024-07114 Aliases CVE-2024-7675 GHSA-h5x9-4j34-4q7p

DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software

LOW 35CWE-416Published 2024-09-30 · Updated 2025-08-26

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

A maliciously crafted DWF file, when parsed in w3dtk.dll through Autodesk Navisworks, can force a Use-After-Free. A malicious actor can leverage this vulnerability to cause a crash or execute arbitrary code in the context of the current process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00213 11th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Autodesk	Navisworks Freedom	2025; 2024; 2023; 2022	—	No fix listed	CNA
Autodesk	Navisworks Simulate	2025; 2024; 2023; 2022	—	No fix listed	CNA
Autodesk	Navisworks Manage	2025; 2024; 2023; 2022	—	No fix listed	CNA

Navisworks Freedom VendorAutodesk Affected 2025; 2024; 2023; 2022 Fixed in — No fix listed CNA
Navisworks Simulate VendorAutodesk Affected 2025; 2024; 2023; 2022 Fixed in — No fix listed CNA
Navisworks Manage VendorAutodesk Affected 2025; 2024; 2023; 2022 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:autodesk:navisworks:2025:::::::*	2025	Vulnerable	Autodesk
cpe:2.3:a:autodesk:navisworks:2025.1:::::::*	2025.1	Vulnerable	Autodesk
cpe:2.3:a:autodesk:navisworks:2025.2:::::::*	2025.2	Vulnerable	Autodesk

cpe:2.3:a:autodesk:navisworks:2025:*:*:*:*:*:*:* Versions 2025 Vulnerable ·Autodesk
cpe:2.3:a:autodesk:navisworks:2025.1:*:*:*:*:*:*:* Versions 2025.1 Vulnerable ·Autodesk
cpe:2.3:a:autodesk:navisworks:2025.2:*:*:*:*:*:*:* Versions 2025.2 Vulnerable ·Autodesk

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-7675
2026-10-03 Alias added: GHSA-h5x9-4j34-4q7p

References

Other 1

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0015

TI-2022-09364 Out-of-bounds write in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD… CVSS 3.1HIGH 7.8
TI-2022-09362 Out-of-bounds write in Autodesk Navisworks, Advanced Steel, Civil 3D, AutoCAD, AutoCAD… CVSS 3.1HIGH 7.8
TI-2021-17343 Out-of-bounds write in Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD®… CVSS 3.1HIGH 7.8
TI-2021-17342 Out-of-bounds read in Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoCAD®… CVSS 3.1HIGH 7.8
TI-2024-11756 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software CVSS 3.1HIGH 7.8
TI-2024-11755 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software CVSS 3.1HIGH 7.8

See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences