CVE-2024-23151 Overview
CVE-2024-23151 is an out-of-bounds write vulnerability [CWE-787] in the ASMkern229A.dll component used by Autodesk AutoCAD and related products. The flaw is triggered when the library parses a maliciously crafted .3dm file. An attacker who convinces a user to open a weaponized file can crash the application, corrupt in-memory data, or execute arbitrary code in the context of the current user process. The vulnerability affects the full AutoCAD family, including AutoCAD Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D, Civil 3D, and Advance Steel.
Critical Impact
Arbitrary code execution in the context of the AutoCAD process on Windows workstations after a user opens a crafted 3DM file.
Affected Products
- Autodesk AutoCAD and AutoCAD Architecture
- Autodesk AutoCAD Electrical, Map 3D, Mechanical, MEP, and Plant 3D
- Autodesk Civil 3D and Advance Steel
Discovery Timeline
- 2024-06-25 - CVE-2024-23151 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23151
Vulnerability Analysis
The vulnerability resides in ASMkern229A.dll, a shared modeling kernel library loaded by AutoCAD when handling Rhino .3dm geometry files. During parsing, the library writes past the bounds of an allocated buffer when specific fields in the input file exceed expected sizes. This memory corruption occurs before any content is rendered, so opening the file is sufficient to trigger the fault. An attacker who controls the layout of the corrupted region can pivot the primitive into arbitrary code execution inside the AutoCAD process.
Root Cause
The defect maps to Common Weakness Enumeration CWE-787: Out-of-bounds Write. ASMkern229A.dll fails to validate length or index fields parsed from untrusted 3DM data before writing into a fixed-size structure. Attacker-controlled values overrun the destination buffer and overwrite adjacent memory, including function pointers or object metadata used later by the kernel.
Attack Vector
Exploitation requires local user interaction. A victim opens a malicious .3dm file delivered through email, a shared drawing package, a design collaboration portal, or a project repository. The attack executes in the security context of the logged-in AutoCAD user, so the resulting foothold inherits whatever engineering data, network shares, and credentials that account can reach.
No verified public proof-of-concept is available. See the Autodesk Security Advisory ADSK-SA-2024-0010 for parser-level details.
Detection Methods for CVE-2024-23151
Indicators of Compromise
- Unexpected crashes of acad.exe or child processes shortly after opening a .3dm file, with Windows Error Reporting entries referencing ASMkern229A.dll.
- .3dm files arriving from external sources with anomalous size, unusual header padding, or mismatched internal length fields.
- AutoCAD processes spawning shells (cmd.exe, powershell.exe) or network utilities immediately after file open events.
Detection Strategies
- Hunt for process lineage where acad.exe (or product-specific AutoCAD binary) is the parent of scripting, LOLBins, or remote access tooling.
- Alert on new DLL loads or unsigned modules injected into AutoCAD processes after 3DM file activity.
- Correlate email or file-share telemetry that delivers .3dm attachments to endpoints running affected AutoCAD versions.
Monitoring Recommendations
- Enable Windows crash dump collection on engineering workstations to capture faults inside ASMkern229A.dll for triage.
- Forward endpoint process, module-load, and file-write telemetry to a centralized data lake for retrospective hunting.
- Track AutoCAD version inventories to identify hosts running builds still exposed to the flaw.
How to Mitigate CVE-2024-23151
Immediate Actions Required
- Apply the fixed AutoCAD releases listed in the Autodesk advisory to every affected workstation.
- Restrict opening of .3dm files that originate outside vetted engineering repositories until patches are deployed.
- Enforce standard user rights for AutoCAD operators so a successful exploit does not gain administrative privileges.
Patch Information
Autodesk has published fixed versions and remediation guidance in Autodesk Security Advisory ADSK-SA-2024-0010. Update AutoCAD, AutoCAD Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D, Civil 3D, and Advance Steel to the versions specified in the advisory.
Workarounds
- Block inbound .3dm attachments at the email gateway when they arrive from untrusted external senders.
- Require design files to be staged in a scanning sandbox before engineers open them in AutoCAD.
- Disable auto-preview and thumbnail generation for CAD file formats in Windows Explorer on engineering hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
