PT-2021-4402 · Autodesk · Autodesk Navisworks

Published 2021-09-14 · Updated 2021-09-28 · CVE-2021-27046

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autodesk Navisworks versions 2019 through 2022

Description The issue is related to a Memory Corruption vulnerability when handling PDF files, potentially allowing code execution through maliciously crafted DLL files. This vulnerability may be exploited by loading arbitrary DLL files, leading to code execution.

Recommendations For Autodesk Navisworks versions 2019 through 2022, update to a version that includes the fix for this issue to prevent potential code execution through malicious PDF files.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2021-05032

CVE-2021-27046

ZDI-21-1063

Affected Products

Autodesk Navisworks

References · 6

• https://osv.dev/vulnerability/CVE-2021-27046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27046 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1063 · Security Note
• https://bdu.fstec.ru/vul/2021-05032 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2021-0008 · Vendor Advisory
• https://t.me/cibsecurity/28923 · Telegram Post