CVE-2024-0446: Autodesk AutoCAD Buffer Overflow Vulnerability

CVE-2024-0446 Overview

CVE-2024-0446 is an out-of-bounds write vulnerability [CWE-787] affecting Autodesk AutoCAD and multiple AutoCAD-based products. The flaw resides in the ASMKERN228A.dll and ASMdatax229A.dll components used to parse STP, CATPART, and MODEL files. A maliciously crafted file forces a write outside the allocated memory bounds when opened in a vulnerable AutoCAD process. Successful exploitation can crash the application, corrupt in-memory data, or achieve arbitrary code execution in the context of the current user.

Critical Impact
Opening a weaponized CAD file in Autodesk AutoCAD or a derivative product can lead to arbitrary code execution under the current user's privileges.

Affected Products

Autodesk AutoCAD and AutoCAD Architecture
Autodesk AutoCAD Electrical, Mechanical, MEP, and Map 3D
Autodesk AutoCAD Plant 3D, Civil 3D, and Advance Steel

Discovery Timeline

2024-02-22 - CVE-2024-0446 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0446

Vulnerability Analysis

The vulnerability lives in two Autodesk shape-modeling libraries, ASMKERN228A.dll and ASMdatax229A.dll, that AutoCAD loads when importing third-party CAD interchange formats. When these libraries parse a specially crafted STP (STEP), CATPART (CATIA V5 part), or MODEL (CATIA V4) file, they write data past the end of an allocated buffer. The write primitive can corrupt adjacent heap structures, function pointers, or object metadata, giving an attacker a path from parser input to code execution within the AutoCAD process.

Root Cause

The root cause is improper bounds validation while processing attacker-controlled fields inside the CAD file. Structures such as geometry records, string lengths, or entity counts are trusted during deserialization, and the parser writes into a destination buffer sized for the expected value rather than the value supplied by the file.

Attack Vector

Exploitation requires local user interaction. An attacker delivers a malicious STP, CATPART, or MODEL file through email, a project sharing platform, a supplier hand-off, or a compromised network share. When an engineer opens the file in AutoCAD or any listed AutoCAD-based product, the parser triggers the out-of-bounds write. There is no authentication or network exposure requirement, but the victim must open the file.

No verified public proof-of-concept or in-the-wild exploitation has been documented for this CVE. Refer to the Autodesk Security Advisory ADSK-SA-2024-0002 for vendor-side technical detail.

Detection Methods for CVE-2024-0446

Indicators of Compromise

Unexpected crashes of acad.exe when opening .stp, .catpart, or .model files, especially with faulting modules ASMKERN228A.dll or ASMdatax229A.dll.
Child processes spawned by acad.exe such as cmd.exe, powershell.exe, or rundll32.exe shortly after a CAD file open event.
Outbound network connections initiated by acad.exe to non-Autodesk destinations following file import.

Detection Strategies

Alert on Windows Error Reporting or crash dumps referencing ASMKERN228A.dll or ASMdatax229A.dll as the faulting module.
Monitor endpoint telemetry for AutoCAD process ancestry anomalies, such as scripting hosts or LOLBins launched from acad.exe.
Inspect email gateways and file-sharing platforms for inbound STP, CATPART, and MODEL attachments from untrusted senders.

Monitoring Recommendations

Baseline normal AutoCAD behavior per engineering workstation and flag deviations in module loads, child processes, and network egress.
Capture and retain process creation, image load, and file open events on engineering endpoints to support post-incident triage.

How to Mitigate CVE-2024-0446

Immediate Actions Required

Inventory all installations of AutoCAD, AutoCAD Architecture, Electrical, Mechanical, MEP, Map 3D, Plant 3D, Civil 3D, and Advance Steel across the environment.
Apply the fixed versions identified in the Autodesk security advisories to every affected host.
Restrict opening of STP, CATPART, and MODEL files to trusted, verified sources until patches are deployed.

Patch Information

Autodesk has published fixed builds and mitigation guidance in the following advisories: ADSK-SA-2024-0002, ADSK-SA-2024-0004, and ADSK-SA-2024-0009. Administrators should map each deployed AutoCAD-family product and version against the fixed release listed in the applicable advisory.

Workarounds

Block or quarantine inbound .stp, .catpart, and .model attachments at the email gateway when not required for business workflows.
Enforce application allowlisting and least-privilege on engineering workstations to limit post-exploitation impact.
Educate CAD users to validate the origin of interchange files before opening and to report unexpected AutoCAD crashes.

bash

# Configuration example: identify installed AutoCAD-family products on Windows endpoints
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.Publisher -like "*Autodesk*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation |
  Format-Table -AutoSize