CVE-2024-23125: Autodesk AutoCAD Electrical Buffer Overflow

CVE-2024-23125 is a stack-based buffer overflow in Autodesk AutoCAD Electrical triggered by malicious SLDPRT files. Attackers can exploit this to crash systems, access sensitive data, or execute code. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-23125 Overview

CVE-2024-23125 is a stack-based buffer overflow vulnerability affecting multiple Autodesk applications. The flaw resides in ODXSW_DLL.dll, which parses SolidWorks part (SLDPRT) files. A maliciously crafted SLDPRT file processed through an affected Autodesk product triggers memory corruption on the stack. Attackers can leverage the condition to crash the application, read sensitive process memory, or execute arbitrary code in the context of the current user. The vulnerability is tracked under CWE-121: Stack-based Buffer Overflow and CWE-787: Out-of-bounds Write.

Critical Impact
Successful exploitation grants arbitrary code execution in the context of the user running the affected Autodesk application, enabling full compromise of design workstations.

Affected Products

Autodesk AutoCAD and AutoCAD Architecture
Autodesk AutoCAD Electrical, Mechanical, MEP, and Map 3D
Autodesk AutoCAD Plant 3D, Civil 3D, and Advance Steel

Discovery Timeline

2024-02-22 - CVE-2024-23125 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23125

Vulnerability Analysis

The vulnerability exists in ODXSW_DLL.dll, the component Autodesk applications use to parse SolidWorks SLDPRT files. When the library processes a crafted SLDPRT file, it writes attacker-controlled data beyond the bounds of a fixed-size stack buffer. The out-of-bounds write corrupts adjacent stack memory, including saved return addresses and structured exception handler (SEH) records on Windows.

Exploitation requires a local user to open the malicious file, typically delivered by phishing or shared project repositories. Because Autodesk products run with the privileges of the interactive user, successful exploitation yields code execution at that privilege level. In engineering environments, those accounts frequently hold access to intellectual property and design repositories.

Root Cause

The root cause is missing or insufficient bounds validation when ODXSW_DLL.dll copies parsed record data from an SLDPRT file into a stack-allocated buffer. The parser trusts a length or count field embedded in the file format instead of validating it against the destination buffer size.

Attack Vector

The attack vector is local and user-assisted. An attacker crafts an SLDPRT file with malformed structures that trigger the overflow. The victim opens the file in an affected Autodesk product, and the parser dispatches the malicious content to ODXSW_DLL.dll, corrupting the stack. See the Autodesk Security Advisory ADSK-SA-2024-0002 for vendor-confirmed technical details. No public proof-of-concept is available at the time of writing.

Detection Methods for CVE-2024-23125

Indicators of Compromise

Unexpected crashes of acad.exe or related Autodesk processes with Windows Error Reporting entries referencing ODXSW_DLL.dll.
SLDPRT files arriving from untrusted email senders, external file shares, or unmanaged USB media.
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned from an Autodesk process shortly after opening a file.

Detection Strategies

Hunt for Autodesk process crashes correlated with recent SLDPRT file opens using endpoint telemetry.
Monitor for anomalous process lineage in which Autodesk binaries launch scripting or LOLBin executables.
Inspect file gateways and email attachments for SLDPRT files and validate them against known-good sources.

Monitoring Recommendations

Enable Windows Error Reporting collection and forward faulting module data to a central log store.
Alert on modifications to Autodesk installation directories or the loading of unsigned DLLs by Autodesk processes.
Track user behavior when Autodesk applications suddenly initiate outbound network connections after opening a design file.

How to Mitigate CVE-2024-23125

Immediate Actions Required

Apply the fixed versions listed in the Autodesk Security Advisory ADSK-SA-2024-0002 to all affected AutoCAD 2024 and derivative products.
Restrict the opening of SLDPRT files to trusted sources only and quarantine untrusted samples for review.
Ensure Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) are enforced system-wide on engineering workstations.

Patch Information

Autodesk released patched versions of AutoCAD 2024 and the AutoCAD-based verticals (Architecture, Electrical, Mechanical, MEP, Map 3D, Plant 3D, Civil 3D, and Advance Steel). Consult the Autodesk Security Advisory ADSK-SA-2024-0002 for the exact fixed build numbers and download links.

Workarounds

Block inbound SLDPRT attachments at the email gateway until patches are deployed across the environment.
Use application allowlisting to prevent Autodesk processes from spawning shells, script hosts, or rundll32.exe.
Enforce least-privilege by running Autodesk applications under standard user accounts rather than local administrators.

bash

# Configuration example: block SLDPRT execution via AppLocker file hash rule
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny \
  -PathCondition "%USERPROFILE%\Downloads\*.SLDPRT"