CVE-2024-23135 Overview
CVE-2024-23135 is a use-after-free vulnerability [CWE-416] in the ASMkern228A.dll component shipped with multiple Autodesk applications. Parsing a maliciously crafted SolidWorks Part (SLDPRT) file triggers the flaw. An attacker who convinces a user to open the file can chain this issue with other vulnerabilities to execute arbitrary code in the context of the current process.
The vulnerability affects the entire Autodesk AutoCAD product family, including the vertical products built on the AutoCAD platform. Exploitation requires local access and user interaction, since the target must open the crafted file.
Critical Impact
A crafted SLDPRT file processed by ASMkern228A.dll can lead to arbitrary code execution in the user's security context, enabling attackers to run commands, drop payloads, or move laterally from engineering workstations.
Affected Products
- Autodesk AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical
- Autodesk AutoCAD MEP, AutoCAD Plant 3D, AutoCAD Map 3D
- Autodesk Civil 3D and Advance Steel
Discovery Timeline
- 2024-02-22 - CVE-2024-23135 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23135
Vulnerability Analysis
The flaw resides in ASMkern228A.dll, a shared library that implements ACIS (Autodesk Shape Manager) kernel parsing routines used by AutoCAD and its vertical products. When the library parses a specially crafted SLDPRT file, an object is freed while a dangling reference to that memory is retained. Subsequent operations dereference the stale pointer, producing a use-after-free condition.
Use-after-free primitives on Windows applications typically allow attackers to reclaim the freed allocation with controlled data. When the freed object contains virtual function pointers or callback structures, the attacker can redirect execution flow. Autodesk's advisory notes that chaining this issue with additional memory-corruption vulnerabilities can yield reliable code execution.
Root Cause
The root cause is improper lifetime management inside the ASM kernel's SLDPRT importer. The parser releases an internal geometry or entity object during file processing but continues to reference it later in the same code path. This mismatch between object destruction and reference tracking is the classic CWE-416 pattern.
Attack Vector
Exploitation requires an attacker to deliver a weaponized SLDPRT file to a target user. Common delivery paths include email attachments, project file shares, engineering collaboration platforms, and drive-by download of design assets. When the user opens the file in an affected Autodesk application, ASMkern228A.dll parses the content and triggers the use-after-free. Code executes with the privileges of the current user, which on engineering workstations often includes access to sensitive CAD projects and network shares.
No verified public proof-of-concept code is available. Refer to the Autodesk Security Advisory ADSK-SA-2024-0002 and Autodesk Security Advisory ADSK-SA-2024-0004 for vendor-supplied technical context.
Detection Methods for CVE-2024-23135
Indicators of Compromise
- Unexpected SLDPRT files arriving via email, chat, or external file shares to CAD users.
- AutoCAD or vertical product processes (acad.exe, AecArchXBase.exe, and similar) crashing with access violations referencing ASMkern228A.dll.
- AutoCAD child processes launching command interpreters such as cmd.exe, powershell.exe, or rundll32.exe.
- Outbound network connections from AutoCAD processes to untrusted hosts immediately after opening a design file.
Detection Strategies
- Hunt for process creation events where the parent is an Autodesk binary and the child is a shell, script host, or regsvr32.exe.
- Monitor Windows Error Reporting (WER) for repeated faulting-module entries pointing at ASMkern228A.dll.
- Inspect SLDPRT files at the mail and web gateway for structural anomalies before delivery to design teams.
Monitoring Recommendations
- Enable command-line and module-load auditing on all workstations running affected Autodesk products.
- Alert on any unsigned DLL loaded into an AutoCAD process image and on process injection targeting AutoCAD.
- Correlate crash telemetry with file-open activity to surface exploitation attempts that fail before achieving code execution.
How to Mitigate CVE-2024-23135
Immediate Actions Required
- Apply the fixed versions listed in the Autodesk Security Advisory ADSK-SA-2024-0002 and ADSK-SA-2024-0004 to all AutoCAD, Civil 3D, Advance Steel, and vertical product installations.
- Instruct CAD users to open SLDPRT files only when the source is verified and expected.
- Restrict local administrator rights on engineering workstations so that successful exploitation cannot escalate beyond the user's context.
Patch Information
Autodesk released updated builds addressing the use-after-free in ASMkern228A.dll across the AutoCAD 2024 and 2023 product families. Consult the vendor advisories ADSK-SA-2024-0002 and ADSK-SA-2024-0004 for exact fixed version numbers per product SKU and download links.
Workarounds
- Block .sldprt attachments at the email gateway when no legitimate business need exists.
- Use application allowlisting to prevent AutoCAD child processes such as cmd.exe and powershell.exe from executing.
- Isolate CAD workstations that must open externally sourced files into a segmented network zone with restricted egress.
- Enable Windows Defender Exploit Guard mitigations (CFG, ACG, DEP) for Autodesk executables to increase exploitation cost.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
