CVE-2024-23143 Overview
CVE-2024-23143 is an out-of-bounds memory access vulnerability affecting multiple Autodesk AutoCAD products. The flaw resides in ASMkern229A.dll and ASMBASE229A.dll, which parse 3DM, MODEL, and X_B file formats. A maliciously crafted file triggers an out-of-bounds read and/or out-of-bounds write during parsing. An attacker can leverage this condition to crash the application, disclose sensitive process memory, or execute arbitrary code in the context of the current user. The weakness is tracked under [CWE-125] (Out-of-bounds Read).
Critical Impact
Successful exploitation allows arbitrary code execution in the user's process context through a single crafted CAD file opened by the victim.
Affected Products
- Autodesk AutoCAD and AutoCAD Architecture
- Autodesk AutoCAD Electrical, Mechanical, MEP, Map 3D, and Plant 3D
- Autodesk Civil 3D and Advance Steel
Discovery Timeline
- 2024-06-25 - CVE-2024-23143 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23143
Vulnerability Analysis
The vulnerability is triggered when Autodesk applications parse 3DM, MODEL, or X_B geometry files through the Autodesk Shape Manager (ASM) kernel libraries ASMkern229A.dll and ASMBASE229A.dll. The parser fails to validate buffer boundaries when interpreting structured geometry records embedded in these file formats. This produces both out-of-bounds reads and out-of-bounds writes during file deserialization.
Out-of-bounds reads can expose adjacent heap memory to attacker-controlled processing paths, resulting in information disclosure. Out-of-bounds writes corrupt adjacent memory structures and can be shaped to overwrite function pointers, vtables, or heap metadata. Combined, these primitives support arbitrary code execution in the process context of the user running the CAD application.
Root Cause
The root cause is missing or insufficient bounds checking in the geometry parsers exported by ASMkern229A.dll and ASMBASE229A.dll. Length fields inside 3DM, MODEL, and X_B file structures are trusted without validation against the actual allocated buffer size. When these files contain manipulated size or offset values, the parser walks past valid memory regions.
Attack Vector
Exploitation requires local file access and user interaction. The victim must open a malicious 3DM, MODEL, or X_B file in an affected Autodesk product. Delivery vectors include phishing emails containing project files, compromised design asset repositories, and shared engineering collaboration folders. No authentication or elevated privileges are required for the attacker.
See the Autodesk Security Advisory ADSK-SA-2024-0009 for technical guidance and fixed build details.
Detection Methods for CVE-2024-23143
Indicators of Compromise
- Unexpected crashes of acad.exe or related Autodesk processes with Windows Error Reporting entries referencing ASMkern229A.dll or ASMBASE229A.dll.
- Child processes spawned by AutoCAD applications, such as cmd.exe, powershell.exe, or rundll32.exe, immediately after opening a design file.
- Inbound 3DM, MODEL, or X_B files from untrusted external sources or unusual email attachments.
Detection Strategies
- Monitor Autodesk application processes for abnormal memory access violations and crash dumps referencing the ASM kernel DLLs.
- Alert on AutoCAD-family processes spawning script interpreters or performing outbound network connections outside of licensed activation endpoints.
- Correlate file-open events involving CAD file types with subsequent process anomalies through EDR telemetry.
Monitoring Recommendations
- Enable command-line and process-lineage logging on engineering workstations to capture post-exploitation activity.
- Track file writes and process creations under the AutoCAD installation and user profile directories.
- Baseline normal DLL load behavior for AutoCAD processes and alert on unsigned or unexpected modules loading into these processes.
How to Mitigate CVE-2024-23143
Immediate Actions Required
- Apply the patched versions listed in Autodesk Security Advisory ADSK-SA-2024-0009 to all AutoCAD-family installations.
- Restrict opening of 3DM, MODEL, and X_B files to those received from verified internal sources or trusted vendors.
- Isolate engineering workstations that process externally sourced CAD files behind stricter egress controls.
Patch Information
Autodesk released fixed builds addressing this vulnerability across AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Map 3D, AutoCAD Plant 3D, Civil 3D, and Advance Steel. Refer to the Autodesk Security Advisory ADSK-SA-2024-0009 for exact fixed version numbers and download links.
Workarounds
- Block delivery of 3DM, MODEL, and X_B file attachments at the email gateway when patching cannot be completed immediately.
- Enforce least-privilege user accounts for CAD operators to limit the impact of code execution in the process context.
- Require file scanning and provenance checks on shared engineering repositories before files are opened locally.
# Example: block risky CAD file extensions at an SMB share via PowerShell FSRM
New-FsrmFileGroup -Name "BlockedCADFiles" -IncludePattern @("*.3dm","*.model","*.x_b")
New-FsrmFileScreen -Path "D:\Engineering\Inbound" -IncludeGroup "BlockedCADFiles" -Active
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
