CVE-2024-23142 Overview
CVE-2024-23142 is a use-after-free vulnerability [CWE-416] affecting multiple Autodesk applications. The flaw resides in the atf_dwg_consumer.dll, rose_x64_vc15.dll, and libodxdll components used to parse CATPART, STP, and MODEL files. An attacker who convinces a user to open a maliciously crafted file can trigger the condition and, when chained with other vulnerabilities, achieve code execution in the context of the current process.
Critical Impact
Successful exploitation leads to arbitrary code execution within the AutoCAD process, giving attackers access to the local user's data and privileges on the workstation.
Affected Products
- Autodesk AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D
- Autodesk AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
- Autodesk Civil 3D and Autodesk Advance Steel
Discovery Timeline
- 2024-06-25 - CVE-2024-23142 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-23142
Vulnerability Analysis
The vulnerability is a use-after-free condition triggered during parsing of CAD interchange formats. When Autodesk applications process CATPART (CATIA part), STP (STEP), or MODEL files, the affected libraries free a memory object but retain a dangling reference. Subsequent operations dereference that pointer, allowing an attacker to influence the freed memory region.
Exploitation requires user interaction. A victim must open the crafted file within an affected Autodesk application. The attack vector is local, and the process runs with the user's privileges. When combined with additional primitives, an attacker can convert the memory corruption into arbitrary code execution inside the CAD application process.
The attack surface is significant because CAD files are routinely exchanged between architects, engineers, and manufacturing partners. Users treat these files as trusted design assets, which increases the likelihood of successful social engineering.
Root Cause
The root cause is improper lifetime management of heap-allocated objects within atf_dwg_consumer.dll, rose_x64_vc15.dll, and libodxdll. The parsers release memory backing an object but continue to hold references that are later reused during file traversal, satisfying the classic [CWE-416] pattern.
Attack Vector
Exploitation follows a predictable social-engineering path. An attacker delivers a weaponized CATPART, STP, or MODEL file through email, a shared design portal, or a third-party vendor exchange. When the target opens the file in a vulnerable Autodesk product, the parser triggers the free-then-reuse sequence and gives the attacker control over freed-object contents. No verified proof-of-concept code is publicly available. Refer to the Autodesk Security Advisory ADSK-SA-2024-0009 for vendor-supplied technical context.
Detection Methods for CVE-2024-23142
Indicators of Compromise
- Unexpected child processes spawned by acad.exe or related Autodesk executables shortly after opening a CAD file
- CATPART, STP, or MODEL files arriving from untrusted senders or unusual external file-sharing services
- Application crashes or exception logs referencing atf_dwg_consumer.dll, rose_x64_vc15.dll, or libodxdll
Detection Strategies
- Monitor process telemetry for AutoCAD processes launching command interpreters, script hosts, or network utilities
- Alert on unsigned or newly written DLLs loaded into Autodesk product processes
- Correlate Windows Error Reporting (WER) events for the affected DLLs with recent file-open activity
Monitoring Recommendations
- Ingest endpoint telemetry from engineering workstations into a SIEM or data lake for behavioral analysis
- Track inbound CAD file transfers through email gateways and file-sharing platforms
- Baseline normal Autodesk product behavior to surface anomalous module loads, crashes, and outbound connections
How to Mitigate CVE-2024-23142
Immediate Actions Required
- Inventory all Autodesk installations across engineering workstations and identify vulnerable versions
- Apply the patched releases referenced in the Autodesk security advisory as soon as they are validated
- Restrict opening of CATPART, STP, and MODEL files from untrusted sources until patches are deployed
Patch Information
Autodesk has published fixes and remediation guidance in Autodesk Security Advisory ADSK-SA-2024-0009. Administrators should consult the advisory for the specific fixed versions that correspond to each affected product family, including AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, and Advance Steel.
Workarounds
- Enforce a file-vetting workflow that validates CAD file provenance before opening
- Run Autodesk applications under standard user accounts to limit the blast radius of code execution
- Use application control policies to prevent AutoCAD processes from launching shells, scripting engines, or LOLBins
# Example Windows Defender Application Control policy fragment
# Block AutoCAD from spawning common living-off-the-land binaries
New-CIPolicyRule -DriverFilePath 'C:\Windows\System32\cmd.exe' -Level FileName -Deny
New-CIPolicyRule -DriverFilePath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -Level FileName -Deny
# Apply the policy scoped to acad.exe parent processes via WDAC supplemental policy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
