CVE-2024-23141: Autodesk AutoCAD Use-After-Free Vulnerability

CVE-2024-23141 Overview

CVE-2024-23141 is a double free vulnerability [CWE-415] in the libodxdll component used by multiple Autodesk applications. A maliciously crafted MODEL file, when parsed through affected Autodesk products, triggers a memory corruption condition. Chained with other flaws, this can lead to arbitrary code execution in the context of the current process.

Exploitation requires local access and user interaction, typically by convincing a user to open a weaponized MODEL file. The vulnerability affects the full AutoCAD product family and specialty vertical products built on the same shared library.

Critical Impact
A crafted MODEL file parsed by libodxdll can free the same memory region twice, corrupting heap metadata and enabling code execution in the AutoCAD process context.

Affected Products

Autodesk AutoCAD (base product and vertical editions)
Autodesk AutoCAD Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D
Autodesk Civil 3D and Autodesk Advance Steel

Discovery Timeline

2024-06-25 - CVE-2024-23141 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23141

Vulnerability Analysis

The flaw resides in libodxdll, a shared parsing library used across the Autodesk AutoCAD product family to process MODEL files. When the library encounters specific malformed structures within a MODEL file, it releases the same heap allocation more than once. This condition constitutes a classic double free [CWE-415].

Double free vulnerabilities corrupt heap allocator metadata. An attacker who controls subsequent allocations can leverage the corrupted state to produce arbitrary write primitives. According to the vendor advisory, this vulnerability can be chained with other issues to achieve code execution in the current process.

Exploitation requires the victim to open the malicious file locally. Because AutoCAD runs with the privileges of the interactive user, successful exploitation grants attacker-controlled execution at that privilege level.

Root Cause

The root cause is improper lifecycle management of heap-allocated objects during MODEL file deserialization. The parser fails to invalidate or null out a pointer after the initial free() call. A later code path then dereferences and frees the same pointer again, corrupting the allocator's free list.

Attack Vector

Delivery vectors include email attachments, shared network drives, project file exchanges, and supply-chain distribution of CAD assets. The attacker crafts a MODEL file with structures that force the vulnerable code path in libodxdll. When the target opens the file in any affected Autodesk application, the double free triggers and the exploit chain executes.

No synthetic proof-of-concept is provided. Refer to the Autodesk Security Advisory ADSK-SA-2024-0009 for vendor technical details.

Detection Methods for CVE-2024-23141

Indicators of Compromise

MODEL files received from untrusted external sources, particularly those with unusual size, malformed headers, or embedded objects that do not match expected schema
Unexpected crashes of acad.exe or related Autodesk processes when opening files, followed by anomalous child process creation
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by an Autodesk executable
Outbound network connections initiated by AutoCAD processes to non-Autodesk destinations

Detection Strategies

Monitor process lineage for Autodesk applications spawning script interpreters or LOLBins immediately after file open events
Alert on Autodesk process crashes correlated with recently written MODEL files in user download or temp directories
Deploy YARA or file-content rules that inspect MODEL files for structural anomalies known to trigger libodxdll parsing errors

Monitoring Recommendations

Enable process creation and image load telemetry on workstations running AutoCAD and vertical products
Log file open events for .model and other AutoCAD-consumed file extensions delivered via email or removable media
Track memory-related crash events in Windows Error Reporting (WER) for AutoCAD binaries and forward to a central SIEM for correlation

How to Mitigate CVE-2024-23141

Immediate Actions Required

Apply the patched versions listed in the Autodesk Security Advisory ADSK-SA-2024-0009 across all AutoCAD and vertical product installations
Inventory endpoints running affected Autodesk products and prioritize patching for users who regularly exchange files with external parties
Instruct users to open MODEL and other CAD files only from trusted sources until patches are deployed

Patch Information

Autodesk has released updated versions of AutoCAD and the affected vertical products that remediate the double free in libodxdll. Consult the vendor advisory for exact fixed version numbers per product line and apply the corresponding update through the Autodesk Access installer or enterprise deployment tooling.

Workarounds

Restrict AutoCAD execution to standard user accounts to limit the impact of successful code execution
Use application allowlisting to block Autodesk processes from launching script interpreters or unsigned binaries
Quarantine MODEL files received from external sources and inspect them in an isolated environment before opening on production workstations

bash

# Example: enumerate installed Autodesk products and versions on Windows
Get-WmiObject -Class Win32_Product | \
  Where-Object { $_.Vendor -like "*Autodesk*" } | \
  Select-Object Name, Version, InstallDate