CVE-2024-23138: Autodesk Advance Steel Buffer Overflow

CVE-2024-23138 Overview

CVE-2024-23138 is a stack-based buffer overflow vulnerability affecting Autodesk DWG TrueView and multiple AutoCAD products. The flaw is triggered when the affected application parses a maliciously crafted DWG file. An attacker who convinces a user to open a weaponized DWG file can crash the application, read sensitive process memory, or execute arbitrary code within the context of the current user.

The vulnerability is tracked under [CWE-121] (Stack-based Buffer Overflow) and [CWE-787] (Out-of-bounds Write). Exploitation requires local file access and user interaction, but no privileges on the target system.

Critical Impact
Arbitrary code execution in the context of the current user through a maliciously crafted DWG file opened in Autodesk DWG TrueView or AutoCAD-based products.

Affected Products

Autodesk DWG TrueView
Autodesk AutoCAD, AutoCAD LT, AutoCAD Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D
Autodesk Advance Steel and Autodesk Civil 3D

Discovery Timeline

2024-03-18 - CVE-2024-23138 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23138

Vulnerability Analysis

The vulnerability resides in the DWG file parsing logic used by Autodesk DWG TrueView and shared across the AutoCAD product family. When the parser processes structures inside a specially crafted DWG file, it writes attacker-controlled data beyond the bounds of a stack buffer. This corrupts adjacent stack memory, including saved return addresses and local variables.

An attacker who controls the overflowed data can influence program flow. Successful exploitation results in arbitrary code execution with the privileges of the user running the affected Autodesk application. Failed exploitation typically triggers a process crash or reveals data from adjacent memory.

Root Cause

The root cause is missing or incorrect bounds validation on length or offset fields consumed during DWG object parsing. Untrusted values from the file are used to copy data into a fixed-size stack buffer without enforcing the buffer capacity, matching the pattern described by [CWE-121] and [CWE-787].

Attack Vector

Exploitation requires an attacker to deliver a malicious .dwg file to a target user and convince the user to open it in a vulnerable Autodesk product. Delivery vectors include email attachments, shared design repositories, contractor file exchanges, and drive-by downloads. The attack vector is local with required user interaction, but the impact spans confidentiality, integrity, and availability.

No public proof-of-concept is currently associated with this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Autodesk Security Advisory ADSK-SA-2024-0006 for vendor technical details.

Detection Methods for CVE-2024-23138

Indicators of Compromise

Unexpected crashes of acad.exe, dwgviewr.exe, or related Autodesk processes shortly after opening a DWG file.
DWG files originating from untrusted sources, especially those delivered by email or unmanaged file-sharing services.
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by an Autodesk application.
Outbound network connections initiated by Autodesk processes to unfamiliar or newly registered domains.

Detection Strategies

Monitor for process crashes with exception codes consistent with stack corruption (for example, STATUS_STACK_BUFFER_OVERRUN) in Autodesk binaries.
Alert on Autodesk applications launching interactive shells, script hosts, or living-off-the-land binaries.
Correlate DWG file open events with subsequent suspicious process, file, and network activity on the same host.

Monitoring Recommendations

Enable and centralize Windows Error Reporting and application crash telemetry for CAD workstations.
Log file provenance for DWG files entering the environment through mail gateways, web proxies, and collaboration platforms.
Track version inventory of all Autodesk products across engineering endpoints to identify unpatched hosts.

How to Mitigate CVE-2024-23138

Immediate Actions Required

Apply the fixed versions listed in Autodesk Security Advisory ADSK-SA-2024-0006 for every affected product in your environment.
Restrict opening of DWG files sourced from outside the organization until patches are deployed.
Educate CAD users on the risk of opening DWG attachments from unknown or unverified senders.

Patch Information

Autodesk has released security updates for DWG TrueView, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Advance Steel, and Civil 3D. Refer to the Autodesk Security Advisory ADSK-SA-2024-0006 for the specific fixed version corresponding to each product and release year.

Workarounds

Enforce application allowlisting to prevent Autodesk processes from launching shells or script interpreters.
Run Autodesk applications as standard users rather than administrators to limit impact of successful exploitation.
Quarantine and scan inbound DWG files in a sandboxed environment before allowing them onto engineering workstations.

bash

# Example: block Autodesk applications from spawning shells via Windows Defender ASR-like policy
# (Illustrative; verify rule GUIDs and behavior for your endpoint platform before deployment)
New-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a `
                 -AttackSurfaceReductionRules_Actions Enabled