CVE-2023-29073

The vulnerability occurs during parsing of a maliciously crafted MODEL file by Autodesk AutoCAD. Improper handling of input data leads to a heap-based buffer overflow, which corresponds to CWE-122 and CWE-787 weaknesses (writing out of buffer bounds). An attacker can deliver such a file to the victim, for example via email or a shared network resource, and simply opening the file in the vulnerable application triggers the exploit.

An attacker can cause application crashes (DoS), read sensitive data from process memory, or execute arbitrary code (RCE) in the context of the currently logged-in user.

Apply patches available from the vendor according to the references: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018. It is recommended to immediately update the software to the version indicated by Autodesk. As an additional precautionary measure, exercise special caution when opening MODEL files from untrusted sources.

Autodesk AutoCAD 2023, Autodesk AutoCAD 2024, Autodesk AutoCAD Advance Steel 2023, Autodesk AutoCAD Advance Steel 2024