CVE-2024-23136

A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

Score

CVSS 3.1 7.8 High

Status

Analyzed - psirt@autodesk.com

Published

2024-02-22

Last modified

2025-08-26

Weaknesses

CWE-822

Affected products

• Advance Steel (Autodesk)
• Autocad (Autodesk)
• Autocad Advance Steel (Autodesk)
• Autocad Architecture (Autodesk)
• Autocad Civil 3d (Autodesk)
• Autocad Electrical (Autodesk)
• Autocad Map 3d (Autodesk)
• Autocad Mechanical (Autodesk)
• Autocad Mechnaical (Autodesk)
• Autocad Mep (Autodesk)
• Autocad Plant 3d (Autodesk)
• Civil 3d (Autodesk)

References

• https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002
• https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004