PT-2022-21887 · Autodesk · Autodesk Autocad

Published 2022-09-29 · Updated 2022-10-05 · CVE-2022-33885

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autodesk AutoCAD versions 2022 through 2023

Description The issue arises when a maliciously crafted file, specifically X B, CATIA, or PDF, is parsed through the software, leading to an out-of-bounds write that can result in arbitrary code execution.

Recommendations For Autodesk AutoCAD versions 2022 and 2023, update to a version that includes a fix for this issue to prevent arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-33885

ZDI-22-1304

ZDI-22-1305

ZDI-22-1307

ZDI-22-1309

ZDI-22-1310

ZDI-22-1312

ZDI-22-1313

Affected Products

Autodesk Autocad

References · 10

• https://zerodayinitiative.com/advisories/ZDI-22-1309 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-33885 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1304 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33885 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1305 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1312 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1307 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1310 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1313 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2022-0020 · Vendor Advisory