CVE-2024-23149: Autodesk AutoCAD RCE Vulnerability

CVE-2024-23149 Overview

CVE-2024-23149 is an out-of-bounds read vulnerability [CWE-125] in the ODXSW_DLL.dll component used by multiple Autodesk applications. A maliciously crafted SLDDRW file, when parsed through Autodesk software, triggers memory access beyond allocated boundaries. Attackers can leverage this flaw to crash the application, read sensitive process memory, or execute arbitrary code in the context of the current process.

Exploitation requires user interaction, typically opening a weaponized SLDDRW drawing file. The vulnerability affects the entire Autodesk AutoCAD product family and related engineering suites.

Critical Impact
Successful exploitation enables arbitrary code execution in the context of the AutoCAD process, potentially leading to full compromise of the engineering workstation and theft of proprietary CAD data.

Affected Products

Autodesk AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D
Autodesk AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
Autodesk Civil 3D and Autodesk Advance Steel

Discovery Timeline

2024-06-25 - CVE-2024-23149 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23149

Vulnerability Analysis

The flaw resides in ODXSW_DLL.dll, a library invoked by Autodesk applications when parsing SLDDRW slide drawing files. The parser fails to validate structural boundaries within the file format before reading data into memory. An attacker who supplies a malformed SLDDRW file causes the DLL to read past the end of an allocated buffer.

An out-of-bounds read [CWE-125] in a complex file parser is dangerous for two reasons. First, adjacent memory may contain sensitive process data, leaking secrets to attacker-controlled fields. Second, when the leaked data influences subsequent control-flow logic such as function pointers, virtual tables, or size calculations, the primitive can be chained into arbitrary code execution.

Exploitation requires local access and user interaction. A victim must open the crafted SLDDRW file, which attackers typically deliver through phishing emails, project sharing platforms, or supply-chain compromise of CAD assets.

Root Cause

The root cause is missing bounds validation inside the SLDDRW parsing routines of ODXSW_DLL.dll. The parser trusts length or offset fields embedded in the input file without verifying that the referenced data resides within the allocated buffer. Malformed structural fields cause the read pointer to traverse into unmapped or unintended memory regions.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious SLDDRW file and delivers it to a target engineer. When the victim opens the file in AutoCAD or a related product, ODXSW_DLL.dll parses the malformed structure and triggers the out-of-bounds read. The resulting memory corruption or information disclosure runs in the context of the AutoCAD process.

No verified public proof-of-concept exists. The vulnerability manifests in the SLDDRW parsing path of ODXSW_DLL.dll. Refer to the Autodesk Security Advisory ADSK-SA-2024-0009 for technical details.

Detection Methods for CVE-2024-23149

Indicators of Compromise

Unexpected crashes of acad.exe or related Autodesk processes with access violation exceptions referencing ODXSW_DLL.dll.
SLDDRW files arriving from untrusted email attachments, external file shares, or unverified project sources.
Child processes spawned by acad.exe such as cmd.exe, powershell.exe, or rundll32.exe following an SLDDRW open event.

Detection Strategies

Monitor Windows Error Reporting (WER) and application crash telemetry for faults inside ODXSW_DLL.dll.
Correlate SLDDRW file open events with subsequent anomalous process behavior on engineering workstations.
Hunt for AutoCAD process trees that execute scripting interpreters, network utilities, or credential access tools.

Monitoring Recommendations

Enable command-line and process-creation auditing on all workstations running Autodesk products.
Log file access to .slddrw, .dwg, and related CAD extensions from network shares and email quarantines.
Alert on Autodesk applications loading unsigned DLLs or performing outbound network connections outside baseline behavior.

How to Mitigate CVE-2024-23149

Immediate Actions Required

Apply the security updates listed in Autodesk Security Advisory ADSK-SA-2024-0009 to every affected AutoCAD, Civil 3D, and Advance Steel installation.
Instruct engineering teams to avoid opening SLDDRW files from untrusted or unverified sources.
Inventory all workstations running affected Autodesk products and prioritize patching for internet-facing or high-value hosts.

Patch Information

Autodesk released fixed versions for the affected products. Consult Autodesk Security Advisory ADSK-SA-2024-0009 for the exact patched build numbers per product family. Deploy the vendor-supplied updates through your standard software distribution mechanism and verify installation via version checks.

Workarounds

Block inbound SLDDRW attachments at the email gateway when they originate from external senders.
Restrict opening of CAD files to a controlled review workflow, using an isolated sandbox or virtual machine for untrusted files.
Apply application allowlisting to prevent Autodesk processes from spawning shell interpreters or scripting engines.

bash

# Example: PowerShell inventory check for AutoCAD installations
Get-WmiObject -Class Win32_Product | Where-Object {
    $_.Vendor -like "*Autodesk*"
} | Select-Object Name, Version, InstallDate