CVE-2022-41303

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in Autodesk FBX SDK 2020 version causing the application to reference a memory location controlled by an unauthorized third party, thereby running arbitrary code on the system.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	FBX SDK	2020.3.1

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0022Patch, Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0022Patch, Vendor Advisory

Timeline

Published: Oct 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-413047.8An Out-Of-Bounds Write Vulnerability in Autodesk FBX SDK 2020 version and prior may lead to code execution through maliciously crafted FBX f CVE-2022-413057.8A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by wr CVE-2022-413067.8A maliciously crafted PCT file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write acc CVE-2022-413077.8A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by re CVE-2022-413087.8A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by re CVE-2022-413097.8A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by wr CVE-2022-41315.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before CVE-2022-413107.8A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by wr CVE-2022-413115.4A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2 CVE-2022-413125.4A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2 CVE-2022-413135.4A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2 CVE-2022-413147.8Uncontrolled search path in some Intel(R) Network Adapter installer software may allow an authenticated user to potentially enable escalatio