CVE-2024-7991

Autodesk AutoCAD DWG Out-of-Bounds Write Code Execution Vulnerability

Published Oct 29, 2024 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Autodesk

AutoCAD

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD LT

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD Architecture

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD Electrical

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD MAP 3D

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD Mechanical

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD MEP

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD Plant 3D

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

Civil 3D

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

Advance Steel

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

DWG TrueView

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7

Autodesk

RealDWG

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7

Configuration 1 [-]

OR	cpe:2.3:a:autodesk:autocad::::::::
	cpe:2.3:a:autodesk:autocad_advance_steel::::::::
	cpe:2.3:a:autodesk:autocad_architecture::::::::
	cpe:2.3:a:autodesk:autocad_civil_3d::::::::
	cpe:2.3:a:autodesk:autocad_electrical::::::::
	cpe:2.3:a:autodesk:autocad_lt::::::::
	cpe:2.3:a:autodesk:autocad_mechanical::::::::
	cpe:2.3:a:autodesk:autocad_mep::::::::
	cpe:2.3:a:autodesk:autocad_plant_3d::::::::
	cpe:2.3:a:autodesk:dwg_trueview::::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2024-48821	A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.188% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021

History

Aug 26, 2025 6:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Autodesk advance Steel Autodesk autocad Map 3d Autodesk civil 3d Autodesk realdwg
CPEs		cpe:2.3:a:autodesk:advance_steel:2022:::::::* cpe:2.3:a:autodesk:advance_steel:2023:::::::* cpe:2.3:a:autodesk:advance_steel:2024:::::::* cpe:2.3:a:autodesk:advance_steel:2025:::::::* cpe:2.3:a:autodesk:autocad:2022:::::::* cpe:2.3:a:autodesk:autocad:2023:::::::* cpe:2.3:a:autodesk:autocad:2024:::::::* cpe:2.3:a:autodesk:autocad:2025:::::::* cpe:2.3:a:autodesk:autocad_architecture:2022:::::::* cpe:2.3:a:autodesk:autocad_architecture:2023:::::::* cpe:2.3:a:autodesk:autocad_architecture:2024:::::::* cpe:2.3:a:autodesk:autocad_architecture:2025:::::::* cpe:2.3:a:autodesk:autocad_electrical:2022:::::::* cpe:2.3:a:autodesk:autocad_electrical:2023:::::::* cpe:2.3:a:autodesk:autocad_electrical:2024:::::::* cpe:2.3:a:autodesk:autocad_electrical:2025:::::::* cpe:2.3:a:autodesk:autocad_lt:2022:::::::* cpe:2.3:a:autodesk:autocad_lt:2023:::::::* cpe:2.3:a:autodesk:autocad_lt:2024:::::::* cpe:2.3:a:autodesk:autocad_lt:2025:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2022:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2023:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2024:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2025:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2022:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2023:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2024:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2025:::::::* cpe:2.3:a:autodesk:autocad_mep:2022:::::::* cpe:2.3:a:autodesk:autocad_mep:2023:::::::* cpe:2.3:a:autodesk:autocad_mep:2024:::::::* cpe:2.3:a:autodesk:autocad_mep:2025:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2022:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2023:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2024:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2025:::::::* cpe:2.3:a:autodesk:civil_3d:2022:::::::* cpe:2.3:a:autodesk:civil_3d:2023:::::::* cpe:2.3:a:autodesk:civil_3d:2024:::::::* cpe:2.3:a:autodesk:civil_3d:2025:::::::* cpe:2.3:a:autodesk:dwg_trueview:2023:::::::* cpe:2.3:a:autodesk:dwg_trueview:2024:::::::* cpe:2.3:a:autodesk:dwg_trueview:2025:::::::* cpe:2.3:a:autodesk:realdwg:2024:::::::* cpe:2.3:a:autodesk:realdwg:2025:::::::*
Vendors & Products		Autodesk advance Steel Autodesk autocad Map 3d Autodesk civil 3d Autodesk realdwg

Jul 15, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00027}`	epss `{'score': 0.00029}`

Apr 11, 2025 5:45 PM References updated View changes

Type	Values Removed	Values Added
References	https://autodesk.com/trust/security-advisories/adsk-sa-2024-0021

Apr 11, 2025 5:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021

Feb 10, 2025 9:00 PM Description updated View changes

Type	Values Removed	Values Added
Description	A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force an Out-of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.	A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

Nov 1, 2024 4:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Autodesk Autodesk autocad Autodesk autocad Advance Steel Autodesk autocad Architecture Autodesk autocad Civil 3d Autodesk autocad Electrical Autodesk autocad Lt Autodesk autocad Mechanical Autodesk autocad Mep Autodesk autocad Plant 3d Autodesk dwg Trueview
CPEs		cpe:2.3:a:autodesk:autocad:::::::: cpe:2.3:a:autodesk:autocad_advance_steel:::::::: cpe:2.3:a:autodesk:autocad_architecture:::::::: cpe:2.3:a:autodesk:autocad_civil_3d:::::::: cpe:2.3:a:autodesk:autocad_electrical:::::::: cpe:2.3:a:autodesk:autocad_lt:::::::: cpe:2.3:a:autodesk:autocad_mechanical:::::::: cpe:2.3:a:autodesk:autocad_mep:::::::: cpe:2.3:a:autodesk:autocad_plant_3d:::::::: cpe:2.3:a:autodesk:dwg_trueview::::::::
Vendors & Products		Autodesk Autodesk autocad Autodesk autocad Advance Steel Autodesk autocad Architecture Autodesk autocad Civil 3d Autodesk autocad Electrical Autodesk autocad Lt Autodesk autocad Mechanical Autodesk autocad Mep Autodesk autocad Plant 3d Autodesk dwg Trueview

Oct 30, 2024 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 29, 2024 10:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force an Out-of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Title		Autodesk AutoCAD DWG Out-of-Bounds Write Code Execution Vulnerability
Weaknesses		CWE-787
References		https://autodesk.com/trust/security-advisories/adsk-sa-2024-0021
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

Earlier changes (3)

Subscriptions

Autodesk Advance Steel Autocad Autocad Advance Steel Autocad Architecture Autocad Civil 3d Autocad Electrical Autocad Lt Autocad Map 3d Autocad Mechanical Autocad Mep Autocad Plant 3d Civil 3d Dwg Trueview Realdwg

Weaknesses