PT-2022-17519 · Autodesk · Autodesk Autocad+1

Published 2022-03-07 · Updated 2022-04-19 · CVE-2022-25791

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autodesk AutoCAD versions 2019 through 2022 Autodesk Navisworks versions 2022

Description A Memory Corruption issue exists in the parsing of DWF and DWFX files, potentially leading to code execution through maliciously crafted DLL files. This issue may be exploited remotely.

Recommendations For Autodesk AutoCAD versions 2019 through 2022, update to a version that includes the fix for this issue. For Autodesk Navisworks version 2022, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of DWF and DWFX file parsing functionality in affected Autodesk products until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-25791

ZDI-22-464

ZDI-22-558

ZDI-22-561

ZDI-22-564

ZDI-22-572

ZDI-22-573

Affected Products

Autodesk Autocad

Autodesk Navisworks

References · 9

• https://zerodayinitiative.com/advisories/ZDI-22-558 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-561 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-464 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-564 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-573 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2022-0005 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25791 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-572 · Security Note