CVE-2024-23147: Autodesk AutoCAD RCE Vulnerability

CVE-2024-23147 Overview

CVE-2024-23147 is an out-of-bounds write vulnerability [CWE-787] affecting multiple Autodesk products. A maliciously crafted CATPART, X_B, or STEP file triggers memory corruption when parsed by ASMKERN228A.dll and ASMKERN229A.dll. The flaw produces a write access violation during file parsing. Chained with other vulnerabilities, it enables code execution in the context of the current process. Exploitation requires local access and user interaction, such as opening a crafted file in an affected Autodesk application.

Critical Impact
Attackers can achieve code execution within Autodesk applications by tricking users into opening a malicious CAD file, compromising confidentiality, integrity, and availability on the affected workstation.

Affected Products

Autodesk AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D
Autodesk AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
Autodesk Civil 3D and Autodesk Advance Steel

Discovery Timeline

2024-06-25 - CVE-2024-23147 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23147

Vulnerability Analysis

The vulnerability resides in the ASMKERN228A.dll and ASMKERN229A.dll components that Autodesk applications use to parse CAD interchange formats. When these libraries process a malformed CATPART (CATIA part), X_B (Parasolid binary), or STEP (ISO 10303) file, they perform a write beyond the bounds of an allocated buffer. The resulting write access violation corrupts adjacent memory structures. When combined with other primitives, attackers can convert this corruption into arbitrary code execution in the process running the affected Autodesk product.

Root Cause

The root cause is an out-of-bounds write [CWE-787] in the ASM geometric kernel parsers. Insufficient validation of size fields or geometry records inside the imported file allows attacker-controlled data to drive the destination and length of a write operation. Because ASMKERN228A.dll and ASMKERN229A.dll are loaded directly into the AutoCAD process, corrupted memory affects the host application's address space.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted .CATPART, .X_B, or .STEP file through email, a shared drive, a project repository, or a supply-chain path. The victim opens or imports the file in an affected Autodesk product. Parsing triggers the memory corruption. The attacker must chain the write primitive with additional flaws to bypass modern mitigations and reach reliable code execution.

No public proof-of-concept exploit is available. Refer to the Autodesk Security Advisory ADSK-SA-2024-0009 for vendor technical details.

Detection Methods for CVE-2024-23147

Indicators of Compromise

Unexpected crashes or write access violations in acad.exe when opening .CATPART, .X_B, or .STEP files, with ASMKERN228A.dll or ASMKERN229A.dll on the call stack.
Autodesk processes spawning uncommon child processes such as cmd.exe, powershell.exe, or script hosts shortly after a CAD file import.
CAD interchange files arriving from untrusted email senders, external file shares, or unusual project directories.

Detection Strategies

Hunt for Windows Error Reporting entries and application crash telemetry where the faulting module is ASMKERN228A.dll or ASMKERN229A.dll.
Correlate file-open events for .catpart, .x_b, and .step extensions with subsequent process creation events from AutoCAD-family executables.
Alert on anomalous memory allocation, DLL loads, or shellcode-like behavior originating from Autodesk processes.

Monitoring Recommendations

Enable EDR process, module load, and file-write telemetry on engineering workstations running Autodesk software.
Monitor file distribution channels (email gateways, file shares, PLM systems) for CAD interchange files from unverified sources.
Track installed Autodesk product versions across the fleet and compare them against the fixed builds listed in ADSK-SA-2024-0009.

How to Mitigate CVE-2024-23147

Immediate Actions Required

Apply the fixed versions listed in Autodesk Security Advisory ADSK-SA-2024-0009 for all AutoCAD, Civil 3D, and Advance Steel installations.
Inventory workstations running affected Autodesk products and prioritize patching for users who routinely import third-party CAD files.
Instruct designers and engineers to avoid opening .CATPART, .X_B, and .STEP files from untrusted or unverified sources until patches are deployed.

Patch Information

Autodesk has released updates addressing the memory corruption in ASMKERN228A.dll and ASMKERN229A.dll. Version-specific fix information is documented in Autodesk Security Advisory ADSK-SA-2024-0009. Deploy the update through the Autodesk Access client or your enterprise software distribution system.

Workarounds

Restrict CAD interchange file ingress to a controlled review pipeline that scans and validates files before delivery to designers.
Run Autodesk applications under least-privilege user accounts to limit the blast radius of successful exploitation.
Apply application allowlisting and block Autodesk processes from spawning script interpreters or command shells.

bash

# Verify installed Autodesk product version on Windows
reg query "HKLM\SOFTWARE\Autodesk\AutoCAD" /s /f "ProductVersion"

# Locate vulnerable ASM kernel libraries for inventory
dir /s /b "C:\Program Files\Autodesk\ASMKERN228A.dll" "C:\Program Files\Autodesk\ASMKERN229A.dll"