Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
Priority LOW 36CWE-121Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
A maliciously crafted SLDPRT file when parsed ODXSW_DLL.dll through Autodesk applications can be used to cause a Stack-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00396 34th percentileScored 2026-11-07
Fix Fixed AutoCAD (Autodesk): 2025.0.1, 2024.1.3, 2023.1.5 +2AutoCAD Architecture (Autodesk): 2025.0.1, 2024.1.3, 2023.1.5 +2+7 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Autodesk | AutoCAD | 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 | 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 | Patch available | CNA |
| Autodesk | AutoCAD Architecture | 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 | 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 | Patch available | CNA |
| Autodesk | AutoCAD Electrical | 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 | 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 | Patch available | CNA |
| Autodesk | AutoCAD Mechanical | 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 | 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 | Patch available | CNA |
| Autodesk | AutoCAD MEP | 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 | 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 | Patch available | CNA |
| Autodesk | AutoCAD Plant 3D | 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 | 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 | Patch available | CNA |
| Autodesk | Civil 3D | 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 | 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 | Patch available | CNA |
| Autodesk | Advance Steel | 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 | 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 | Patch available | CNA |
| Autodesk | AutoCAD MAP 3D | 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 | 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 | Patch available | CNA |
- AutoCAD VendorAutodesk Affected 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 Patch available CNA
- AutoCAD Architecture VendorAutodesk Affected 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 Patch available CNA
- AutoCAD Electrical VendorAutodesk Affected 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 Patch available CNA
- AutoCAD Mechanical VendorAutodesk Affected 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 Patch available CNA
- AutoCAD MEP VendorAutodesk Affected 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 Patch available CNA
- AutoCAD Plant 3D VendorAutodesk Affected 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 Patch available CNA
- Civil 3D VendorAutodesk Affected 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 Patch available CNA
- Advance Steel VendorAutodesk Affected 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 Patch available CNA
- AutoCAD MAP 3D VendorAutodesk Affected 2025 to before 2025.0.1; 2024 to before 2024.1.3; 2023 to before 2023.1.5; 2022 to before 2022.1.4; 2021 to before 2021.1.4 Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4 Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:* | 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:* | 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:* | 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:* | 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:* | 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:* | 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:* | 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:* | 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:* | 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 | Vulnerable | Autodesk |
- cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:* Versions 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:* Versions 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:* Versions 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:* Versions 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:* Versions 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:* Versions 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:* Versions 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:* Versions 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:* Versions 2021 to before 2021.1.4; 2022 to before 2022.1.4; 2023 to before 2023.1.5; 2024 to before 2024.1.3; 2025 to before 2025.0.1 Vulnerable ·Autodesk
Remediation
- Fix · CNA AutoCAD (Autodesk) Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4
- Fix · CNA AutoCAD Architecture (Autodesk) Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4
- Fix · CNA AutoCAD Electrical (Autodesk) Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4
- Fix · CNA AutoCAD Mechanical (Autodesk) Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4
- Fix · CNA AutoCAD MEP (Autodesk) Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4
- Fix · CNA AutoCAD Plant 3D (Autodesk) Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4
- Fix · CNA Civil 3D (Autodesk) Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4
- Fix · CNA Advance Steel (Autodesk) Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4
- Fix · CNA AutoCAD MAP 3D (Autodesk) Fixed in 2025.0.1, 2024.1.3, 2023.1.5, 2022.1.4, 2021.1.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Autodesk Advance Steel, AutoCAD and 7 more products 2021.1.4, 2022.1.4 and 3 more versions
17 records Highest priority Priority LOW 17 LOW
Other records, highest priority first
- TI-2024-15258 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwarePriority LOW 38
- TI-2024-15256 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwarePriority LOW 37
- TI-2024-15255 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwarePriority LOW 37
Timeline
- 2026-10-02 Threatist record created from CVE-2024-23125
- 2026-10-03 Alias added: GHSA-q6r9-2g53-c4qf
References
More Autodesk Advance Steel vulnerabilities
- TI-2021-17340 Out-of-bounds read in Inventor CVSS 3.1HIGH 7.8
- TI-2021-17341 Information disclosure in Inventor CVSS 3.1HIGH 7.8
- TI-2022-09360 Out-of-bounds write in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD… CVSS 3.1HIGH 7.8
- TI-2024-15258 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software CVSS 3.1HIGH 7.8
- TI-2021-08615 Improper handling of exceptional conditions in Autodesk Advanced Steel, Civil 3D… CVSS 3.1HIGH 7.8
- TI-2019-05247 Uncontrolled search path in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT… CVSS 3.0HIGH 7.8
Sources
- CVE-2024-23125 · CVE Program
- CVE-2024-23125 · NVD
- FIRST EPSS
- GHSA-q6r9-2g53-c4qf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences