CVE-2024-23140 Overview
CVE-2024-23140 is an out-of-bounds read vulnerability affecting multiple Autodesk applications when parsing maliciously crafted 3DM and MODEL files. The flaw resides in the opennurbs.dll and atf_api.dll components used by AutoCAD and related design products. An attacker who convinces a user to open a specially crafted file can crash the application, disclose sensitive process memory, or execute arbitrary code in the context of the current user. The issue is tracked under CWE-125 and documented in the Autodesk Security Advisory ADSK-SA-2024-0009.
Critical Impact
Successful exploitation can lead to arbitrary code execution in the user's context, enabling attackers to compromise engineering workstations that hold sensitive CAD intellectual property.
Affected Products
- Autodesk AutoCAD and AutoCAD Architecture, Electrical, Map 3D, Mechanical, MEP, and Plant 3D
- Autodesk Civil 3D
- Autodesk Advance Steel
Discovery Timeline
- 2024-06-25 - CVE-2024-23140 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23140
Vulnerability Analysis
The vulnerability is an out-of-bounds read triggered during the parsing of 3DM (Rhino/openNURBS) and MODEL files by Autodesk applications. Parsing logic inside opennurbs.dll and atf_api.dll reads beyond the boundaries of an allocated buffer when handling malformed geometry or metadata structures. This condition produces three possible outcomes: an application crash, disclosure of adjacent process memory, or arbitrary code execution when the out-of-bounds data influences downstream control flow.
Exploitation requires local access and user interaction — a target must open the crafted file inside a vulnerable Autodesk product. Because AutoCAD-family applications are commonly used to exchange models across engineering teams and contractors, malicious files delivered by email, shared drives, or supply-chain channels represent a realistic delivery path.
Root Cause
The underlying defect is missing or insufficient bounds validation on length fields or index values read from the untrusted 3DM/MODEL file. When these values are used to index into or copy from a fixed-size buffer, the parser reads past the buffer boundary. The flaw is classified as CWE-125: Out-of-bounds Read.
Attack Vector
The attack vector is local and requires user interaction. An attacker crafts a malicious 3DM or MODEL file and delivers it to a target through phishing, a shared project repository, or a compromised partner. When the victim opens the file, opennurbs.dll or atf_api.dll parses the malicious structure and triggers the out-of-bounds read. Depending on memory layout, the attacker can chain the primitive with heap-shaping techniques to achieve code execution under the current user's privileges.
No verified public proof-of-concept code is available. Refer to the Autodesk Security Advisory ADSK-SA-2024-0009 for authoritative technical details and fixed versions.
Detection Methods for CVE-2024-23140
Indicators of Compromise
- Unexpected crashes of acad.exe or related Autodesk processes with faulting modules opennurbs.dll or atf_api.dll in Windows Error Reporting.
- Inbound 3DM or MODEL files from untrusted email senders or external file shares that were opened by CAD users.
- Child processes spawned by AutoCAD executables that perform command shell activity, script interpretation, or network egress.
Detection Strategies
- Monitor endpoint telemetry for anomalous child-process creation from acad.exe, AecArchXBase.exe, civilcad.exe, and other Autodesk binaries.
- Alert on module load or crash events referencing opennurbs.dll and atf_api.dll immediately following the opening of a 3DM or MODEL file.
- Correlate file-write events for 3DM/MODEL extensions from browser or mail-client processes with subsequent Autodesk process activity.
Monitoring Recommendations
- Ingest Windows Error Reporting and application crash logs from engineering workstations into a central SIEM for triage.
- Track versions of installed Autodesk products across the fleet and flag hosts running unpatched builds listed in the vendor advisory.
- Baseline normal Autodesk process behavior and alert on deviations such as outbound connections or LOLBins launched from CAD sessions.
How to Mitigate CVE-2024-23140
Immediate Actions Required
- Apply the fixed versions published in the Autodesk Security Advisory ADSK-SA-2024-0009 to all affected AutoCAD, Civil 3D, and Advance Steel installations.
- Restrict opening of 3DM and MODEL files received from untrusted or external sources until systems are patched.
- Communicate the risk to engineering and design teams and enforce a policy of validating file sources before opening.
Patch Information
Autodesk has published updated builds in ADSK-SA-2024-0009 that address the out-of-bounds read in opennurbs.dll and atf_api.dll. Administrators should identify affected products through the advisory's version matrix and deploy the corresponding hotfix or product update. Confirm the patched opennurbs.dll and atf_api.dll versions after deployment.
Workarounds
- Block delivery of 3DM and MODEL file attachments at email and web gateways until patching is complete.
- Run Autodesk applications under standard user accounts to limit the blast radius of successful exploitation.
- Use application allow-listing to prevent AutoCAD child processes from launching interpreters such as cmd.exe, powershell.exe, or wscript.exe.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
