CVE-2024-8587

Autodesk AutoCAD SLDPRT File Parsing Heap-based Buffer Overflow Code Execution Vulnerability

Published Oct 29, 2024 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Heap Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Autodesk

AutoCAD

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD Architecture

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD MAP 3D

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD Mechanical

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD MEP

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

AutoCAD Plant 3D

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

Civil 3D

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Autodesk

Advance Steel

unaffected

Version	Status	Constraints
`2025`	affected	< 2025.1.1
`2024`	affected	< 2024.1.7
`2023`	affected	< 2023.1.7
`2022`	affected	< 2022.1.6

Configuration 1 [-]

OR	cpe:2.3:a:autodesk:advance_steel:2025:::::::*
	cpe:2.3:a:autodesk:autocad:2025:::::::*
	cpe:2.3:a:autodesk:autocad_architecture:2025:::::::*
	cpe:2.3:a:autodesk:autocad_electrical:2025:::::::*
	cpe:2.3:a:autodesk:autocad_mechanical:2025:::::::*
	cpe:2.3:a:autodesk:autocad_mep:2025:::::::*
	cpe:2.3:a:autodesk:autocad_plant_3d:2025:::::::*
	cpe:2.3:a:autodesk:civil_3d:2025:::::::*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2024-49581	A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Heap Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.228% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019

History

Sep 3, 2025 6:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:autodesk:autocad_electrical:2022:::::::* cpe:2.3:a:autodesk:autocad_electrical:2023:::::::* cpe:2.3:a:autodesk:autocad_electrical:2024:::::::*

Aug 26, 2025 6:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Autodesk autocad Map 3d
CPEs		cpe:2.3:a:autodesk:advance_steel:2022:::::::* cpe:2.3:a:autodesk:advance_steel:2023:::::::* cpe:2.3:a:autodesk:advance_steel:2024:::::::* cpe:2.3:a:autodesk:autocad:2022:::::::* cpe:2.3:a:autodesk:autocad:2023:::::::* cpe:2.3:a:autodesk:autocad:2024:::::::* cpe:2.3:a:autodesk:autocad_architecture:2022:::::::* cpe:2.3:a:autodesk:autocad_architecture:2023:::::::* cpe:2.3:a:autodesk:autocad_architecture:2024:::::::* cpe:2.3:a:autodesk:autocad_electrical:2022:::::::* cpe:2.3:a:autodesk:autocad_electrical:2023:::::::* cpe:2.3:a:autodesk:autocad_electrical:2024:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2022:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2023:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2024:::::::* cpe:2.3:a:autodesk:autocad_map_3d:2025:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2022:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2023:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2024:::::::* cpe:2.3:a:autodesk:autocad_mep:2022:::::::* cpe:2.3:a:autodesk:autocad_mep:2023:::::::* cpe:2.3:a:autodesk:autocad_mep:2024:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2022:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2023:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2024:::::::* cpe:2.3:a:autodesk:civil_3d:2022:::::::* cpe:2.3:a:autodesk:civil_3d:2023:::::::* cpe:2.3:a:autodesk:civil_3d:2024:::::::*
Vendors & Products		Autodesk autocad Map 3d

Jul 15, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00012}`	epss `{'score': 0.00017}`

Dec 16, 2024 12:15 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Autodesk AutoCAD SLDPRT File Parsing Heap-based Buffer Overflow Code Execution Vulnerability
Weaknesses		CWE-122

Dec 12, 2024 11:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-122

Dec 12, 2024 11:15 PM Title updated View changes

Type	Values Removed	Values Added
Title	Autodesk AutoCAD SLDPRT File Parsing Heap-based Buffer Overflow Code Execution Vulnerability

Nov 7, 2024 5:45 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Autodesk Autodesk advance Steel Autodesk autocad Autodesk autocad Architecture Autodesk autocad Electrical Autodesk autocad Mechanical Autodesk autocad Mep Autodesk autocad Plant 3d Autodesk civil 3d
Weaknesses		CWE-787
CPEs		cpe:2.3:a:autodesk:advance_steel:2025:::::::* cpe:2.3:a:autodesk:autocad:2025:::::::* cpe:2.3:a:autodesk:autocad_architecture:2025:::::::* cpe:2.3:a:autodesk:autocad_electrical:2025:::::::* cpe:2.3:a:autodesk:autocad_mechanical:2025:::::::* cpe:2.3:a:autodesk:autocad_mep:2025:::::::* cpe:2.3:a:autodesk:autocad_plant_3d:2025:::::::* cpe:2.3:a:autodesk:civil_3d:2025:::::::*
Vendors & Products		Autodesk Autodesk advance Steel Autodesk autocad Autodesk autocad Architecture Autodesk autocad Electrical Autodesk autocad Mechanical Autodesk autocad Mep Autodesk autocad Plant 3d Autodesk civil 3d

Oct 30, 2024 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 29, 2024 9:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Heap Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.
Title		Autodesk AutoCAD SLDPRT File Parsing Heap-based Buffer Overflow Code Execution Vulnerability
Weaknesses		CWE-122
References		https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`