CVE-2022-33887

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A maliciously crafted PDF file when parsed through Autodesk AutoCAD 2023 causes an unhandled exception. An attacker can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code in the context of the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-755

Affected software

Vendor	Product	Versions
n/a	utodesk® AutoCAD®, Advance Steel and Civil 3D®	2023, 2022

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020Vendor Advisory

Timeline

Published: Oct 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-338887.8A malicious crafted Dwg2Spd file when processed through Autodesk DWG application could lead to memory corruption vulnerability by write acce CVE-2022-338897.8A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 could be used to write be CVE-2022-33897.5Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10.CVE-2022-338907.8A maliciously crafted PCT or DWF file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by re CVE-2022-338918.8The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, thi CVE-2022-338927.8Path traversal in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalat CVE-2022-338947.8Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of CVE-2022-338967.8A buffer underflow vulnerability exists in the way Hword of Hancom Office 2020 version 11.0.0.5357 parses XML-based office files. A speciall CVE-2022-338979.1A directory traversal vulnerability exists in the web_server /ajax/remove/ functionality of Robustel R1510 3.1.16. A specially-crafted netwo CVE-2022-338987.8Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software before version 2.0.21.0 may allow an authenticated CVE-2022-339007.2PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.CVE-2022-339017.5Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.