CVE-2024-23136 Overview
CVE-2024-23136 is a memory safety vulnerability in the ASMKERN228A.dll component used by multiple Autodesk applications, including AutoCAD and its industry-specific variants. A maliciously crafted STP (STEP) file causes the parser to dereference an untrusted pointer during processing. When combined with other vulnerabilities, this flaw can lead to arbitrary code execution in the context of the current user process.
The issue is classified as [CWE-822: Untrusted Pointer Dereference]. Exploitation requires local access and user interaction, typically achieved by convincing a user to open a malicious .stp file inside a vulnerable Autodesk product.
Critical Impact
Successful exploitation allows code execution within the affected Autodesk application, exposing engineering workstations to compromise of confidentiality, integrity, and availability.
Affected Products
- Autodesk AutoCAD and AutoCAD Architecture
- Autodesk AutoCAD Electrical, Mechanical, MEP, Map 3D, and Plant 3D
- Autodesk Civil 3D and Advance Steel
Discovery Timeline
- 2024-02-22 - CVE-2024-23136 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23136
Vulnerability Analysis
The flaw resides in ASMKERN228A.dll, a shared kernel library used by the Autodesk product family for parsing 3D geometry files. When an Autodesk application opens a STEP (.stp) file, the DLL processes structured records that describe geometric entities and relationships. A crafted STP file supplies attacker-controlled data that the parser interprets as a valid memory reference.
Because the pointer is derived from untrusted file content without proper validation, the application dereferences an address chosen by the attacker. Combined with additional heap grooming or corruption primitives, this yields control over program flow and enables code execution in the user's session.
Root Cause
The root cause is an untrusted pointer dereference within the STP parsing logic of ASMKERN228A.dll [CWE-822]. The parser trusts embedded offset or reference values from the file rather than validating them against allocated object boundaries or type metadata before dereferencing.
Attack Vector
Exploitation requires a local attack vector with user interaction. An attacker must deliver a malicious .stp file, typically via email, shared drive, or engineering collaboration workflow. When the victim opens the file in an affected Autodesk application, the vulnerable parser executes and triggers the dereference.
See the Autodesk Security Advisory SA-2024-0002 and Autodesk Security Advisory SA-2024-0004 for vendor technical details.
Detection Methods for CVE-2024-23136
Indicators of Compromise
- Unexpected crashes of acad.exe or related Autodesk processes when opening .stp files, with faulting module ASMKERN228A.dll.
- Autodesk application processes spawning command interpreters such as cmd.exe, powershell.exe, or rundll32.exe.
- New or modified executables and scripts written to user profile directories immediately after opening a STEP file.
Detection Strategies
- Monitor Windows Error Reporting and application crash telemetry for exceptions originating in ASMKERN228A.dll.
- Alert on suspicious child processes of Autodesk binaries, which normally do not launch shells or scripting hosts.
- Inspect email gateways and file shares for .stp attachments arriving from untrusted senders.
Monitoring Recommendations
- Enable EDR file-open telemetry on engineering workstations and correlate .stp opens with process crashes or anomalous child processes.
- Track outbound network connections initiated by Autodesk processes shortly after file open events.
- Baseline Autodesk software versions across the fleet and flag hosts running unpatched builds identified in the Autodesk advisories.
How to Mitigate CVE-2024-23136
Immediate Actions Required
- Apply the fixed Autodesk product versions listed in advisories SA-2024-0002 and SA-2024-0004.
- Restrict opening of .stp files from untrusted sources until patching is complete.
- Run Autodesk applications under standard user accounts to limit the impact of code execution.
Patch Information
Autodesk has released updated versions of AutoCAD, AutoCAD Architecture, Electrical, Mechanical, MEP, Map 3D, Plant 3D, Civil 3D, and Advance Steel that resolve the untrusted pointer dereference in ASMKERN228A.dll. Refer to the Autodesk advisories linked above for the specific fixed build numbers per product and release year.
Workarounds
- Block inbound .stp attachments at email and web gateways where they are not required for business workflows.
- Use application allowlisting to prevent Autodesk processes from launching scripting hosts or shells.
- Instruct users to import STEP files only from verified engineering partners over authenticated channels.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
