PT-2022-6644 · Autodesk · Autodesk 3Ds Max+1

Published 2022-12-19 · Updated 2023-07-06 · CVE-2023-25001

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Autodesk Navisworks versions 2022 through 2023 Autodesk 3dsMax (affected versions not specified)

Description A maliciously crafted SKP file can be used to trigger a use-after-free issue, potentially leading to code execution. This is related to the parsing of SKP files in the affected software. The exploitation of this issue may allow an attacker to execute arbitrary code using a specially crafted file.

Recommendations For Autodesk Navisworks versions 2022 through 2023, consider avoiding the use of SKP files from untrusted sources until a patch is available. For Autodesk 3dsMax, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-03090

CVE-2023-25001

ZDI-23-574

ZDI-23-575

ZDI-23-576

ZDI-23-585

Affected Products

Autodesk 3Ds Max

Autodesk Navisworks

References · 10

• https://zerodayinitiative.com/advisories/ZDI-23-574 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-25001 · Security Note
• https://bdu.fstec.ru/vul/2023-03090 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25001 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-585 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2023-0002 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-576 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-575 · Security Note
• https://t.me/cvenotify/53213 · Telegram Post
• https://t.me/cibsecurity/65592 · Telegram Post