CVE-2024-23133 Overview
CVE-2024-23133 is a memory corruption vulnerability affecting Autodesk AutoCAD and related products. A maliciously crafted STP (STEP) file processed by ASMDATAX228A.dll triggers a write access violation when parsed through Autodesk applications. Attackers can chain this flaw with other vulnerabilities to execute code in the context of the current process. The issue is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Exploitation requires local access and user interaction, typically achieved by convincing a user to open a crafted STP file inside AutoCAD or a derivative product.
Critical Impact
Successful exploitation can lead to arbitrary code execution in the context of the current process, compromising confidentiality, integrity, and availability of the affected workstation.
Affected Products
- Autodesk AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical
- Autodesk AutoCAD MEP, AutoCAD Plant 3D, AutoCAD Map 3D
- Autodesk Civil 3D and Advance Steel
Discovery Timeline
- 2024-02-22 - CVE-2024-23133 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23133
Vulnerability Analysis
The flaw resides in ASMDATAX228A.dll, an Autodesk shape modeling component that handles STEP (.stp) file parsing. When the DLL processes a specially crafted STP file, it performs a write operation that violates memory access boundaries. This out-of-bounds write corrupts adjacent memory structures used by the host Autodesk application.
STEP files describe 3D CAD geometry using the ISO 10303 specification. Parsers must validate a large surface of entity definitions, references, and nested structures. Insufficient validation of one or more of these fields leads to the write access violation observed here.
On its own, the memory corruption can crash the application. Chained with a separate primitive, such as a heap-spray or information disclosure bug, an attacker can convert the corruption into arbitrary code execution. Autodesk classifies the impact as high across confidentiality, integrity, and availability.
Root Cause
The root cause is improper bounds checking during STP parsing in ASMDATAX228A.dll. Malformed entity records drive the parser into a state where it writes beyond an allocated buffer, mapping to [CWE-119]. Autodesk has not published detailed structural information about the offending field.
Attack Vector
Exploitation is local and requires user interaction. An attacker delivers a crafted STP file through email, a shared drive, a project repository, or a compromised supplier. When an engineer opens the file in AutoCAD or a supported vertical product, the vulnerable DLL parses it and triggers the write access violation. No verified public proof-of-concept or exploit is currently available.
Detection Methods for CVE-2024-23133
Indicators of Compromise
- Unexpected crashes of acad.exe or related Autodesk process executables when opening STP files, with faulting module ASMDATAX228A.dll.
- Windows Error Reporting (WER) or Application event log entries citing access violations inside ASMDATAX228A.dll.
- STP files arriving from untrusted external senders or unverified supply chain sources.
Detection Strategies
- Monitor for child processes or shell activity spawned by AutoCAD executables shortly after opening a design file.
- Alert on writes to autorun locations, scheduled task creation, or LOLBin execution originating from Autodesk process trees.
- Inspect .stp attachments at the email gateway and quarantine files from unverified external domains.
Monitoring Recommendations
- Ingest endpoint process telemetry from engineering workstations into a central data lake for retrospective hunting.
- Track version and patch level of Autodesk products across the fleet to prioritize unpatched hosts.
- Correlate crash telemetry referencing ASMDATAX228A.dll with file-open events on .stp artifacts.
How to Mitigate CVE-2024-23133
Immediate Actions Required
- Apply the fixed versions listed in the Autodesk security advisories to all affected AutoCAD and vertical products.
- Restrict opening of STP files to those originating from trusted internal projects or verified suppliers.
- Educate CAD users about the risk of opening unsolicited .stp attachments or downloads.
Patch Information
Autodesk published fixes and affected version matrices in Autodesk Security Advisory ADSK-SA-2024-0002 and Autodesk Security Advisory ADSK-SA-2024-0004. Administrators should reference these advisories to identify the specific patched release for each installed product line, including AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, AutoCAD Map 3D, Civil 3D, and Advance Steel.
Workarounds
- Block or quarantine .stp file attachments at the email security gateway until patching is complete.
- Enforce least-privilege on engineering workstations so that a compromised Autodesk process has limited lateral impact.
- Use application allow-listing to prevent Autodesk processes from launching unexpected child binaries.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
