PT-2021-22826 · Autodesk · Autodesk Design Review

Published 2021-07-07 · Updated 2023-08-08 · CVE-2021-40167

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autodesk Design Review (affected versions not specified)

Description The issue arises when a maliciously crafted dwf or .pct file is consumed through the DesignReview.exe application, leading to a memory corruption vulnerability due to a read access violation. This vulnerability, when combined with other vulnerabilities, could potentially lead to code execution in the context of the current process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2021-40167

ZDI-21-776

Affected Products

Autodesk Design Review

References · 4

• https://osv.dev/vulnerability/CVE-2021-40167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40167 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2022-0004 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-776 · Security Note