CVE-2024-23126 Overview
CVE-2024-23126 is a stack-based buffer overflow vulnerability affecting multiple Autodesk AutoCAD products. The flaw resides in CC5Dll.dll, which processes CATPART files when opened through Autodesk applications. A maliciously crafted CATPART file triggers memory corruption during parsing, allowing attackers to cause application crashes, disclose sensitive memory contents, or execute arbitrary code in the context of the current user. The vulnerability is tracked under CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). Exploitation requires local access and user interaction, typically opening a weaponized file.
Critical Impact
Successful exploitation grants arbitrary code execution in the AutoCAD process context, enabling attackers to persist on engineering workstations that often hold proprietary design intellectual property.
Affected Products
- Autodesk AutoCAD, AutoCAD Architecture, AutoCAD Electrical
- Autodesk AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, AutoCAD Map 3D
- Autodesk Civil 3D and Advance Steel
Discovery Timeline
- 2024-02-22 - CVE-2024-23126 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23126
Vulnerability Analysis
The vulnerability lives in CC5Dll.dll, a shared component used by Autodesk applications to parse CATIA Part (CATPART) files. CATPART is a proprietary CAD interchange format frequently exchanged between engineering teams. When the parser reads specific length or index fields from an attacker-controlled CATPART file, it writes data onto the stack without validating that the destination buffer can hold the input. This produces a classic stack-based buffer overflow, mapped to [CWE-121] and [CWE-787]. The overflow overwrites adjacent stack memory, including saved return addresses and structured exception handlers. Attackers can leverage this to redirect execution flow into attacker-supplied shellcode or ROP gadgets, gaining code execution as the AutoCAD user.
Root Cause
The root cause is missing bounds checking during CATPART deserialization inside CC5Dll.dll. The parser trusts size and offset values embedded in the file header rather than validating them against the actual buffer capacity. This is a common pattern in native CAD parsers written in C++ where legacy code handles complex binary geometry structures.
Attack Vector
Exploitation requires the victim to open a malicious CATPART file with a vulnerable Autodesk application. Attackers typically deliver the payload through phishing emails, compromised design collaboration portals, or supply chain contamination of CAD asset libraries. Once opened, the overflow executes payload code with the privileges of the current user. See the Autodesk Security Advisory ADSK-SA-2024-0002 and Autodesk Security Advisory ADSK-SA-2024-0004 for vendor technical details.
// No verified proof-of-concept code is publicly available for CVE-2024-23126.
// The vulnerability is triggered by a malformed CATPART file whose
// internal length fields exceed the fixed-size stack buffer in CC5Dll.dll,
// producing a stack-based buffer overflow during parsing.
Detection Methods for CVE-2024-23126
Indicators of Compromise
- Unexpected crashes of acad.exe or related AutoCAD processes shortly after opening CATPART files.
- CATPART files received from untrusted external sources, especially via email attachments or unknown file shares.
- Child processes spawned by AutoCAD executables, such as cmd.exe, powershell.exe, or rundll32.exe.
Detection Strategies
- Monitor process creation events where AutoCAD binaries spawn shells, scripting engines, or network utilities.
- Alert on Windows Error Reporting (WER) events referencing CC5Dll.dll faults inside Autodesk processes.
- Inspect file writes of .CATPART files landing in user download or temp directories and correlate with subsequent AutoCAD launches.
Monitoring Recommendations
- Enable command-line auditing and Sysmon Event IDs 1, 7, and 11 on engineering workstations running AutoCAD.
- Forward endpoint telemetry to a centralized SIEM to correlate CATPART file activity with process lineage.
- Baseline normal AutoCAD child-process behavior and alert on deviations such as outbound network connections from acad.exe.
How to Mitigate CVE-2024-23126
Immediate Actions Required
- Apply the patched versions listed in Autodesk advisories ADSK-SA-2024-0002 and ADSK-SA-2024-0004 to every affected AutoCAD, Civil 3D, and Advance Steel installation.
- Restrict opening of CATPART files to trusted internal sources until patches are deployed.
- Enforce least-privilege on engineering workstations so exploitation cannot immediately reach administrative context.
Patch Information
Autodesk released fixed versions for AutoCAD 2024, 2023, 2022, and 2021 product families, including Architecture, Electrical, Mechanical, MEP, Plant 3D, Map 3D, Civil 3D, and Advance Steel variants. Refer to Autodesk Security Advisory ADSK-SA-2024-0002 and Autodesk Security Advisory ADSK-SA-2024-0004 for the specific fixed build numbers per product line.
Workarounds
- Block inbound .CATPART attachments at the email gateway if the file type is not required for business workflows.
- Configure Windows Attack Surface Reduction rules to prevent AutoCAD from spawning child processes.
- Train CAD users to validate the provenance of CATPART files before opening them in Autodesk applications.
# Example: block CATPART files via Windows file screen on a shared drive
New-FsrmFileGroup -Name "Blocked CAD Interchange" -IncludePattern @("*.CATPART")
New-FsrmFileScreen -Path "D:\Engineering\Inbound" -IncludeGroup "Blocked CAD Interchange" -Active $true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
