CVE-2021-40166

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by attackers to execute arbitrary code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure Parts Editors, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD	2022, 2021, 2020, 2019

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011Vendor Advisory

Timeline

Published: Oct 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-401677.8A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by rea CVE-2021-40178.8showdoc is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-401706.8An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an CVE-2021-401715.3The absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-IT CVE-2021-401728.8Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings.CVE-2021-401738.8Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings.CVE-2021-401748.8Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings.CVE-2021-401759.8Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution.CVE-2021-401766.1Zoho ManageEngine Log360 before Build 5225 allows stored XSS.CVE-2021-401779.8Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite.CVE-2021-401786.1Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO_PATH key value in the logon settings.CVE-2021-40185.4snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')