CVE-2024-37002

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-457 CWE-908

Affected software

Vendor	Product	Versions
Autodesk	AutoCAD	>= 2025, < 2025.1; >= 2024, < 2024.1.4; >= 2023, < 2023.1.6; >= 2022, < 2022.1.5
Autodesk	AutoCAD Architecture	>= 2025, < 2025.1; >= 2024, < 2024.1.4; >= 2023, < 2023.1.6; >= 2022, < 2022.1.5
Autodesk	AutoCAD Electrical	>= 2025, < 2025.1; >= 2024, < 2024.1.4; >= 2023, < 2023.1.6; >= 2022, < 2022.1.5
Autodesk	AutoCAD Mechanical	>= 2025, < 2025.1; >= 2024, < 2024.1.4; >= 2023, < 2023.1.6; >= 2022, < 2022.1.5
Autodesk	AutoCAD MEP	>= 2025, < 2025.1; >= 2024, < 2024.1.4; >= 2023, < 2023.1.6; >= 2022, < 2022.1.5
Autodesk	AutoCAD Plant 3D	>= 2025, < 2025.1; >= 2024, < 2024.1.4; >= 2023, < 2023.1.6; >= 2022, < 2022.1.5
Autodesk	Civil 3D	>= 2025, < 2025.1; >= 2024, < 2024.1.4; >= 2023, < 2023.1.6; >= 2022, < 2022.1.5
Autodesk	Advance Steel	>= 2025, < 2025.1; >= 2024, < 2024.1.4; >= 2023, < 2023.1.6; >= 2022, < 2022.1.5
Autodesk	AutoCAD MAP 3D	>= 2025, < 2025.1; >= 2024, < 2024.1.4; >= 2023, < 2023.1.6; >= 2022, < 2022.1.5

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009Vendor Advisory

Timeline

Published: Jun 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-370037.8A maliciously crafted DWG and SLDPRT file, when parsed in opennurbs.dll and ODXSW_DLL.dll through Autodesk applications, can be used to caus CVE-2024-370047.8A maliciously crafted SLDPRT file, when parsed in ASMKERN229A.dll through Autodesk applications, can cause a use-after-free vulnerability. T CVE-2024-370057.8A maliciously crafted X_B file, when parsed in pskernel.DLL through Autodesk applications, can force an Out-of-Bound Read. A malicious actor CVE-2024-370067.8A maliciously crafted CATPRODUCT file, when parsed in CC5Dll.dll through Autodesk applications, can lead to a memory corruption vulnerabilit CVE-2024-370077.8A maliciously crafted X_B and X_T file, when parsed in pskernel.DLL through Autodesk applications, can cause a use-after-free vulnerability.CVE-2024-370087.8A maliciously crafted DWG file, when parsed in Revit, can force a stack-based buffer overflow. A malicious actor can leverage this vulnerabi CVE-2024-37019.8The system application (com.transsion.kolun.aiservice) component does not perform an authentication check, which allows attackers to perform CVE-2024-370149.8Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and p CVE-2024-370157.4An issue was discovered in Ada Web Server 20.0. When configured to use SSL (which is not the default setting), the SSL/TLS used to establish CVE-2024-370166.8Mengshen Wireless Door Alarm M70 2024-05-24 allows Authentication Bypass via a Capture-Replay approach.CVE-2024-370178.1asdcplib (aka AS-DCP Lib) 2.13.1 has a heap-based buffer over-read in ASDCP::TimedText::MXFReader::h__Reader::MD_to_TimedText_TDesc in AS_DC CVE-2024-370189.1The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken b