CVE-2023-41139High· 7.8▾ TwilightA maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
autocad < 2024.1autocad >= 2023.0.0, < 2023.1.4autocad >= 2024.0.0, < 2024.1.1autocad_advance_steel < 2023.1.4autocad_advance_steel >= 2024.0.0, < 2024.1.1autocad_architecture < 2023.1.4autocad_architecture >= 2024.0.0, < 2024.1.1autocad_civil_3d < 2023.1.4autocad_civil_3d >= 2024.0.0, < 2024.1.1autocad_electrical < 2023.1.4autocad_electrical >= 2024.0.0, < 2024.1.1autocad_lt < 2023.1.4autocad_lt < 2024.1autocad_lt >= 2024.0.0, < 2024.1.1autocad_map_3d < 2023.1.4autocad_map_3d >= 2024.0.0, < 2024.1.1autocad_mechanical < 2023.1.4autocad_mechanical >= 2024.0.0, < 2024.1.1autocad_mep < 2023.1.4autocad_mep >= 2024.0.0, < 2024.1.1autocad_plant_3d < 2023.1.4autocad_plant_3d >= 2024.0.0, < 2024.1.1Upgrade past the affected range:
autocad 2024.1.1autocad_advance_steel 2024.1.1autocad_architecture 2024.1.1autocad_civil_3d 2024.1.1autocad_electrical 2024.1.1autocad_lt 2024.1.1autocad_map_3d 2024.1.1autocad_mechanical 2024.1.1autocad_mep 2024.1.1autocad_plant_3d 2024.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2022-27867High· 7.8A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerability
CVE-2026-7406High· 7.8A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability
CVE-2026-102637High· 7.1Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
CVE-2026-107672High· 8.8Stack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility
CVE-2026-102636High· 7.1Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
CVE-2026-102638High· 7.1Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop