High severity · published Feb 22, 2024
CVE-2024-23136
Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Advance Steel · Autodesk
2025 before 2025.0.1; 2024 before 2024.1.3; 2023 before 2023.1.5; 2022 before 2022.1.4; 2021 before 2021.1.4 · source: vendor, NVD
AU
AutoCAD · Autodesk
2025 before 2025.0.1; 2024 before 2024.1.3; 2023 before 2023.1.5; 2022 before 2022.1.4; 2021 before 2021.1.4 · source: vendor, NVD, CISA
AA
AutoCAD Architecture · Autodesk
2025 before 2025.0.1; 2024 before 2024.1.3; 2023 before 2023.1.5; 2022 before 2022.1.4; 2021 before 2021.1.4 · source: vendor, NVD
AE
AutoCAD Electrical · Autodesk
2025 before 2025.0.1; 2024 before 2024.1.3; 2023 before 2023.1.5; 2022 before 2022.1.4; 2021 before 2021.1.4 · source: vendor, NVD
AM
AutoCAD MAP 3D · Autodesk
2025 before 2025.0.1; 2024 before 2024.1.3; 2023 before 2023.1.5; 2022 before 2022.1.4; 2021 before 2021.1.4 · source: vendor, NVD
AM
AutoCAD MEP · Autodesk
2025 before 2025.0.1; 2024 before 2024.1.3; 2023 before 2023.1.5; 2022 before 2022.1.4; 2021 before 2021.1.4 · source: vendor, NVD
AM
AutoCAD Mechanical · Autodesk
2025 before 2025.0.1; 2024 before 2024.1.3; 2023 before 2023.1.5; 2022 before 2022.1.4; 2021 before 2021.1.4 · source: vendor, NVD
AP
AutoCAD Plant 3D · Autodesk
2025 before 2025.0.1; 2024 before 2024.1.3; 2023 before 2023.1.5; 2022 before 2022.1.4; 2021 before 2021.1.4 · source: vendor, NVD
C3
Civil 3D · Autodesk
2025 before 2025.0.1; 2024 before 2024.1.3; 2023 before 2023.1.5; 2022 before 2022.1.4; 2021 before 2021.1.4 · source: vendor, NVD
AA
Autocad Advance Steel · Autodesk
2021 before 2021.1.4; 2022 before 2022.1.4; 2023 before 2023.1.5; 2024 before 2024.1.3; 2025 before 2025.0.1 · source: CISA
AC
Autocad Civil 3d · Autodesk
2021 before 2021.1.4; 2022 before 2022.1.4; 2023 before 2023.1.5; 2024 before 2024.1.3; 2025 before 2025.0.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23136
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004
More from Advance Steel
7.8
CVE-2026-7406
BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products
7.8
CVE-2026-16463
DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD
7.8
CVE-2025-8894
PDF File Parsing Heap-Based Buffer Overflow Vulnerability
7.8
CVE-2025-8893
PDF File Parsing Out-of-Bounds Write Vulnerability
7.8
CVE-2025-5048
DGN File Parsing Memory Corruption Vulnerability