PT-2021-7207 · Autodesk+1 · Autodesk Navisworks 2020+2

Published 2021-11-06 · Updated 2022-10-29 · CVE-2022-27527

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PDFTron versions prior to 9.0.7 Autodesk Navisworks 2022 Autodesk Navisworks 2020

Description A Memory Corruption issue may lead to code execution through maliciously crafted DLL files or specially crafted PDF files, allowing an attacker to execute arbitrary code in the context of the current user.

Recommendations For PDFTron versions prior to 9.0.7, update to version 9.0.7 or later. For Autodesk Navisworks 2022, ensure PDFTron is updated to version 9.0.7 or later. For Autodesk Navisworks 2020, consider updating to a newer version of Autodesk Navisworks that includes the fixed PDFTron version. As a temporary workaround, consider restricting the use of PDF files from untrusted sources until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-03696

CVE-2022-27527

Affected Products

Autodesk Navisworks 2020

Autodesk Navisworks 2022

Pdftron

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-27527 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2021-0010 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03696 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27527 · Vendor Advisory
• https://t.me/cibsecurity/41122 · Telegram Post