PT-2022-26674 · Autodesk · Autodesk Maya

Published 2022-12-19 · Updated 2023-04-17 · CVE-2022-42947

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autodesk Maya versions 2022 through 2023

Description A maliciously crafted X B file can be used to write beyond the allocated buffer when parsed through Autodesk Maya. This issue can lead to arbitrary code execution.

Recommendations For Autodesk Maya version 2022, update to a version that fixes the out-of-bounds write issue. For Autodesk Maya version 2023, update to a version that fixes the out-of-bounds write issue. As a temporary workaround, consider restricting the use of X B files in Autodesk Maya until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-42947

ZDI-23-105

ZDI-23-106

Affected Products

Autodesk Maya

References · 8

• https://zerodayinitiative.com/advisories/ZDI-23-105 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-106 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2022-0020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42947 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42947 · Vendor Advisory
• https://t.me/cibsecurity/54883 · Telegram Post
• https://t.me/cvenotify/48455 · Telegram Post
• https://t.me/cvenotify/40196 · Telegram Post