PT-2024-5660 · Autodesk · Autodesk Autocad

Published 2024-08-19 · Updated 2025-07-30 · CVE-2024-7305

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Autodesk AutoCAD (affected versions not specified)

Description A maliciously crafted DWF file, when parsed in AdDwfPdk.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. This issue can be leveraged by a malicious actor to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. The vulnerability is related to the DWF File Handler component of the AdDwfPdk.dll library. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code on affected installations of Autodesk AutoCAD.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2024-06373

CVE-2024-7305

ZDI-24-1153

Affected Products

Autodesk Autocad

References · 15

• https://zerodayinitiative.com/advisories/ZDI-24-1153 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7305 · Vendor Advisory
• https://autodesk.com/trust/security-advisories/adsk-sa-2024-0014 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06373 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-7305 · Security Note
• https://vuldb.com/?id.275189 · Note
• https://t.me/cveNotify/130289 · Telegram Post
• https://twitter.com/shah_sheikh/status/1825783469181645198 · Twitter Post
• https://t.me/cvenotify/91209 · Telegram Post
• https://twitter.com/autumn_good_35/status/1826640539904868380 · Twitter Post
• https://t.me/cvedetector/3577 · Telegram Post
• https://twitter.com/cracbot/status/1827224453694341526 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1825786204584882667 · Twitter Post
• https://twitter.com/SystemTek_UK/status/1826181643335352787 · Twitter Post
• https://twitter.com/CVEnew/status/1825679170451460375 · Twitter Post