CVE-2024-8596

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-8596

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

A

maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

References
Link Resource
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_advance_steel:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_civil_3d:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

11 Apr 2025, 17:15

Type Values Removed Values Added
References
  • {'url': 'https://autodesk.com/trust/security-advisories/adsk-sa-2024-0019', 'source': '[email protected]'}
  • () https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019 -

10 Feb 2025, 21:15

Type Values Removed Values Added
Summary (en) A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force an Out-of-Bound Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. (en) A maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

03 Feb 2025, 17:15

Type Values Removed Values Added
References
  • {'url': 'https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019', 'tags': ['Vendor Advisory'], 'source': '[email protected]'}
  • () https://autodesk.com/trust/security-advisories/adsk-sa-2024-0019 -

01 Nov 2024, 16:17

Type Values Removed Values Added
First Time Autodesk
Autodesk autocad Electrical
Autodesk autocad Mep
Microsoft windows
Autodesk autocad Civil 3d
Autodesk autocad Plant 3d
Autodesk autocad
Autodesk autocad Mechanical
Autodesk autocad Advance Steel
Autodesk autocad Architecture
Microsoft
CPE cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_advance_steel:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_civil_3d:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*
References () https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019 - () https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0019 - Vendor Advisory

01 Nov 2024, 12:57

Type Values Removed Values Added
Summary
  • (es) Un archivo MODEL creado con fines malintencionados, cuando se analiza en libodxdll.dll a través de Autodesk AutoCAD, puede provocar una vulnerabilidad de escritura fuera de los límites. Un actor malintencionado puede aprovechar esta vulnerabilidad para provocar un bloqueo, escribir datos confidenciales o ejecutar código arbitrario en el contexto del proceso actual.

29 Oct 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-29 22:15

Updated : 2025-04-11 17:15

NVD link : CVE-2024-8596

Mitre link : CVE-2024-8596

CVE.ORG link : CVE-2024-8596

JSON object : View

Products Affected

autodesk

microsoft

CWE
CWE-787

Out-of-bounds Write