CVE-2023-41139

HighCVSS 7.8/10Last modified Oct 8, 2026

Description

A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-822CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Nov 23, 2023
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-41146.1A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown CVE-2023-411407.8A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicCVE-2023-411455.3Autodesk users who no longer have an active license for an account can still access cases for that account.CVE-2023-411464.3Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account.CVE-2023-411499.8F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who CVE-2023-41156.1A vulnerability classified as problematic has been found in PHP Jabbers Cleaning Business 1.0. Affected is an unknown function of the file /CVE-2023-411505.4F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary sCVE-2023-411517.5An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crashCVE-2023-411525.4A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitraryCVE-2023-411535.4A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary CVE-2023-411545.4A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrarCVE-2023-411555.4A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers