Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
Priority LOW 36CWE-457Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00386 32nd percentileScored 2026-11-07
Fix Fixed AutoCAD (Autodesk): 2025.1, 2024.1.4, 2023.1.6 +1AutoCAD Architecture (Autodesk): 2025.1, 2024.1.4, 2023.1.6 +1+7 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Autodesk | AutoCAD | 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 | 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 | Patch available | CNA |
| Autodesk | AutoCAD Architecture | 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 | 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 | Patch available | CNA |
| Autodesk | AutoCAD Electrical | 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 | 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 | Patch available | CNA |
| Autodesk | AutoCAD Mechanical | 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 | 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 | Patch available | CNA |
| Autodesk | AutoCAD MEP | 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 | 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 | Patch available | CNA |
| Autodesk | AutoCAD Plant 3D | 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 | 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 | Patch available | CNA |
| Autodesk | Civil 3D | 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 | 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 | Patch available | CNA |
| Autodesk | Advance Steel | 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 | 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 | Patch available | CNA |
| Autodesk | AutoCAD MAP 3D | 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 | 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 | Patch available | CNA |
- AutoCAD VendorAutodesk Affected 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 Patch available CNA
- AutoCAD Architecture VendorAutodesk Affected 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 Patch available CNA
- AutoCAD Electrical VendorAutodesk Affected 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 Patch available CNA
- AutoCAD Mechanical VendorAutodesk Affected 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 Patch available CNA
- AutoCAD MEP VendorAutodesk Affected 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 Patch available CNA
- AutoCAD Plant 3D VendorAutodesk Affected 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 Patch available CNA
- Civil 3D VendorAutodesk Affected 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 Patch available CNA
- Advance Steel VendorAutodesk Affected 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 Patch available CNA
- AutoCAD MAP 3D VendorAutodesk Affected 2025 to before 2025.1; 2024 to before 2024.1.4; 2023 to before 2023.1.6; 2022 to before 2022.1.5 Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5 Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:* | 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:* | 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:* | 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:* | 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:* | 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:* | 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:* | 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:* | 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:* | 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 | Vulnerable | Autodesk |
- cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:* Versions 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:* Versions 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:* Versions 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:* Versions 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:* Versions 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:* Versions 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:* Versions 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:* Versions 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:* Versions 2022 to before 2022.1.5; 2023 to before 2023.1.6; 2024 to before 2024.1.4; 2025 to before 2025.1 Vulnerable ·Autodesk
Remediation
- Fix · CNA AutoCAD (Autodesk) Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5
- Fix · CNA AutoCAD Architecture (Autodesk) Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5
- Fix · CNA AutoCAD Electrical (Autodesk) Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5
- Fix · CNA AutoCAD Mechanical (Autodesk) Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5
- Fix · CNA AutoCAD MEP (Autodesk) Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5
- Fix · CNA AutoCAD Plant 3D (Autodesk) Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5
- Fix · CNA Civil 3D (Autodesk) Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5
- Fix · CNA Advance Steel (Autodesk) Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5
- Fix · CNA AutoCAD MAP 3D (Autodesk) Fixed in 2025.1, 2024.1.4, 2023.1.6, 2022.1.5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Autodesk Advance Steel, AutoCAD and 7 more products 2022.1.5, 2023.1.6 and 2 more versions
17 records Highest priority Priority LOW 17 LOW
Other records, highest priority first
- TI-2024-24551 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwarePriority LOW 36
- TI-2024-24550 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwarePriority LOW 36
- TI-2024-24549 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwarePriority LOW 36
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37002
- 2026-10-03 Alias added: GHSA-354c-38ff-3cw6
References
More Autodesk Advance Steel vulnerabilities
- TI-2021-17340 Out-of-bounds read in Inventor CVSS 3.1HIGH 7.8
- TI-2021-17341 Information disclosure in Inventor CVSS 3.1HIGH 7.8
- TI-2022-09360 Out-of-bounds write in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD… CVSS 3.1HIGH 7.8
- TI-2024-15258 Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software CVSS 3.1HIGH 7.8
- TI-2021-08615 Improper handling of exceptional conditions in Autodesk Advanced Steel, Civil 3D… CVSS 3.1HIGH 7.8
- TI-2019-05247 Uncontrolled search path in Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT… CVSS 3.0HIGH 7.8
Sources
- CVE-2024-37002 · CVE Program
- CVE-2024-37002 · NVD
- FIRST EPSS
- GHSA-354c-38ff-3cw6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences