CVE-2024-23124 Overview
CVE-2024-23124 is an out-of-bounds write vulnerability [CWE-787] in the ASMIMPORT228A.dll component used by Autodesk AutoCAD and related products. A maliciously crafted STP (STEP) file, when parsed by the affected library, triggers memory corruption outside allocated buffer bounds. Attackers can leverage this flaw to crash the application, corrupt process data, or execute arbitrary code in the context of the current user. Exploitation requires local user interaction, typically by convincing the user to open a weaponized STP file. Autodesk assigned the issue high severity and published fixes through advisories ADSK-SA-2024-0002 and ADSK-SA-2024-0004.
Critical Impact
Successful exploitation enables arbitrary code execution in the context of the AutoCAD process, allowing attackers to run malicious code on engineering and design workstations.
Affected Products
- Autodesk AutoCAD and AutoCAD Map 3D
- Autodesk AutoCAD Architecture, Electrical, Mechanical, and MEP
- Autodesk AutoCAD Plant 3D, Civil 3D, and Advance Steel
Discovery Timeline
- 2024-02-22 - CVE-2024-23124 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23124
Vulnerability Analysis
The flaw resides in ASMIMPORT228A.dll, the AutoCAD component that parses STP (STEP ISO 10303) CAD interchange files. When the parser processes malformed geometry or metadata structures, it writes data past the end of an allocated buffer. This out-of-bounds write can overwrite adjacent heap objects, function pointers, or control structures used by the AutoCAD process. An attacker who controls the corrupted memory can pivot the primitive into arbitrary code execution within the user's session. Because AutoCAD is widely deployed on engineering workstations that often hold sensitive intellectual property, successful exploitation offers a high-value foothold for follow-on activity such as credential theft or lateral movement.
Root Cause
The root cause is missing or insufficient bounds validation while deserializing structures from the STP file into internal ACIS/ASM data buffers. The parser trusts size and offset fields present in the file rather than validating them against the actual allocated buffer, allowing a crafted file to steer writes outside the intended region.
Attack Vector
Exploitation requires the victim to open an attacker-supplied STP file in a vulnerable Autodesk product. Delivery typically occurs through phishing, shared project repositories, supply-chain drops in third-party CAD assets, or compromised collaboration platforms. No network exposure is required; the attack executes locally with the privileges of the AutoCAD user. The vulnerability manifests inside ASMIMPORT228A.dll during file import. See the Autodesk security advisories for component and version details.
Detection Methods for CVE-2024-23124
Indicators of Compromise
- Unexpected crashes of acad.exe or Windows Error Reporting entries referencing ASMIMPORT228A.dll shortly after opening an STP file.
- STP files received from untrusted sources or arriving via email, chat, or external file shares.
- AutoCAD processes spawning unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Detection Strategies
- Hunt for process creation events where acad.exe is the parent of scripting or LOLBin binaries.
- Alert on module load events for ASMIMPORT228A.dll correlated with crash telemetry.
- Inspect email and file-share gateways for .stp and .step attachments from external senders.
Monitoring Recommendations
- Enable command-line auditing and Sysmon ProcessCreate and ImageLoad events on workstations running Autodesk products.
- Forward AutoCAD-related crash dumps and Windows Application logs to the SIEM for correlation.
- Track file writes and network connections initiated by acad.exe immediately after STP file opens.
How to Mitigate CVE-2024-23124
Immediate Actions Required
- Apply the fixed AutoCAD 2024 and 2023 releases identified in Autodesk advisories ADSK-SA-2024-0002 and ADSK-SA-2024-0004 across all impacted product variants.
- Block untrusted .stp and .step attachments at email and web gateways until patching is complete.
- Instruct designers to open STP files only from verified internal sources or trusted partners.
Patch Information
Autodesk released updated versions of AutoCAD and the associated verticals that remediate the out-of-bounds write in ASMIMPORT228A.dll. Refer to the Autodesk Security Advisory ADSK-SA-2024-0002 and the Autodesk Security Advisory ADSK-SA-2024-0004 for exact fixed versions and download links for each affected product family.
Workarounds
- Run AutoCAD as a standard user without local administrator rights to limit the blast radius of any successful exploit.
- Restrict STP file imports to a hardened, isolated review workstation until patches are deployed enterprise-wide.
- Enable Windows exploit protection features such as ASLR, DEP, and CFG for acad.exe via Exploit Guard policy.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
