PT-2024-8054 · Autodesk · Cc5Dll.Dll+1

Published 2024-02-14 · Updated 2026-01-22 · CVE-2024-37006

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Autodesk AutoCAD (affected versions not specified)

Description: The issue is caused by a maliciously crafted CATPRODUCT file, which when parsed in CC5Dll.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This can potentially allow for code execution in the context of the current process, especially when combined with other vulnerabilities. The vulnerability is related to an out-of-bounds read in the CC5Dll.dll library, which can be exploited by a remote attacker using a specially crafted file.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2024-09573

CVE-2024-37006

ZDI-24-713

Affected Products

Autodesk Autocad

Cc5Dll.Dll

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-37006 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-713 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2024-0009 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09573 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37006 · Vendor Advisory
• https://twitter.com/TheZDIBugs/status/1801376258405671153 · Twitter Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-23404 · Note
• https://t.me/cvenotify/84308 · Telegram Post
• https://t.me/cveNotify/149554 · Telegram Post