PT-2022-17522 · Autodesk · Autodesk Fbx Review

Published 2022-04-11 · Updated 2022-11-16 · CVE-2022-25794

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autodesk FBX Review versions 1.5.2 and prior

Description An Out-Of-Bounds Read issue may lead to code execution or information disclosure through maliciously crafted ActionScript Byte Code ABC files. These ABC files, created by the Flash compiler, contain executable code. When combined with other issues, this could result in code execution within the context of the current process.

Recommendations For Autodesk FBX Review versions 1.5.2 and prior, consider disabling the parsing of ABC files as a temporary workaround until a patch is available. Restrict access to the ABC file parsing module to minimize the risk of exploitation. Avoid using maliciously crafted ABC files in the affected software until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-25794

ZDI-22-710

Affected Products

Autodesk Fbx Review

References · 5

• https://osv.dev/vulnerability/CVE-2022-25794 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-710 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2022-0006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25794 · Security Note
• https://t.me/cibsecurity/40534 · Telegram Post