CVE-2024-23146 Overview
CVE-2024-23146 is an out-of-bounds write vulnerability [CWE-787] affecting Autodesk AutoCAD and multiple AutoCAD-based products. The flaw resides in pskernel.DLL, which parses Parasolid X_B (binary) and X_T (text) model files. A maliciously crafted X_B or X_T file can trigger an out-of-bounds write during parsing. Successful exploitation allows an attacker to crash the process, corrupt data, or execute arbitrary code in the context of the current user. Exploitation requires local file access and user interaction to open the crafted file.
Critical Impact
Arbitrary code execution in the context of the AutoCAD user process through a crafted Parasolid file, enabling data corruption or full user-context compromise.
Affected Products
- Autodesk AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D
- Autodesk AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
- Autodesk Civil 3D and Advance Steel
Discovery Timeline
- 2024-06-25 - CVE-2024-23146 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23146
Vulnerability Analysis
The vulnerability exists in the Parasolid geometric modeling kernel component pskernel.DLL bundled with Autodesk AutoCAD and derivative products. The library parses Parasolid model files delivered in binary (X_B) and text (X_T) formats used to exchange 3D CAD geometry. During parsing, the library writes data beyond the bounds of an allocated buffer, corrupting adjacent memory. An attacker can shape the file to overwrite process memory in a controlled manner, leading to arbitrary code execution inside the AutoCAD process. Because AutoCAD typically runs with the interactive user's privileges, code executes at that privilege level.
Root Cause
The root cause is missing or insufficient bounds validation in the X_B/X_T file parser inside pskernel.DLL. Attacker-controlled length or index fields in the Parasolid stream are used to compute a destination offset without verifying it against the allocated buffer size. This classic [CWE-787] out-of-bounds write pattern permits controlled memory corruption.
Attack Vector
Exploitation requires local delivery of a crafted .x_b or .x_t file and user interaction to open or import the file into an affected AutoCAD product. Typical delivery channels include email attachments, shared project repositories, and drawing-exchange workflows. Once the user opens the file, the malicious geometry stream is parsed by pskernel.DLL, triggering the out-of-bounds write. No authentication to Autodesk services is required. Refer to the Autodesk Security Advisory ADSK-SA-2024-0009 for technical details.
Detection Methods for CVE-2024-23146
Indicators of Compromise
- Unexpected crashes or Windows Error Reporting (WER) entries citing acad.exe and faulting module pskernel.DLL.
- Presence of .x_b or .x_t files originating from untrusted email, shared drives, or web downloads.
- Child processes spawned by acad.exe such as cmd.exe, powershell.exe, or rundll32.exe shortly after opening a Parasolid file.
Detection Strategies
- Alert on AutoCAD process crashes where the faulting module is pskernel.DLL via Windows Event Log IDs 1000 and 1001.
- Monitor for suspicious process lineage where acad.exe or related AutoCAD executables spawn scripting or LOLBins.
- Inspect email and file-share gateways for .x_b and .x_t attachments from external senders and correlate with subsequent endpoint activity.
Monitoring Recommendations
- Enable Windows Defender Exploit Guard and log module loads of pskernel.DLL from Autodesk processes.
- Collect endpoint telemetry for file-open events targeting Parasolid extensions and forward to your SIEM.
- Track AutoCAD version inventory across engineering workstations to identify unpatched hosts.
How to Mitigate CVE-2024-23146
Immediate Actions Required
- Apply the updates listed in Autodesk Security Advisory ADSK-SA-2024-0009 to all affected AutoCAD, Civil 3D, and Advance Steel installations.
- Block inbound .x_b and .x_t attachments at email and web gateways where the file type is not required for business workflows.
- Restrict AutoCAD users to standard (non-administrator) accounts to contain the impact of user-context code execution.
Patch Information
Autodesk has released fixed versions for AutoCAD 2022, 2023, 2024, and related AutoCAD-based products (AutoCAD Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D, Civil 3D, and Advance Steel). Consult the Autodesk Security Advisory ADSK-SA-2024-0009 for exact fixed version numbers per product and install through the Autodesk Access desktop app or Account portal.
Workarounds
- Do not open X_B or X_T files from untrusted or unverified sources until affected systems are patched.
- Validate Parasolid files by opening them first in an isolated virtual machine or sandbox.
- Use application allow-listing to prevent AutoCAD from spawning scripting interpreters or unexpected child processes.
# Example: block Parasolid attachments at an Exchange transport rule
New-TransportRule -Name "Block Parasolid Attachments" \
-AttachmentExtensionMatchesWords "x_b","x_t" \
-RejectMessageReasonText "Parasolid files are blocked pending CVE-2024-23146 remediation."
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
