CVE-2024-23154: Autodesk AutoCAD Buffer Overflow Vulnerability

CVE-2024-23154 Overview

CVE-2024-23154 is a heap-based buffer overflow vulnerability in the ODXSW_DLL.dll component used by Autodesk AutoCAD and related products. A maliciously crafted SLDPRT (SolidWorks Part) file triggers memory corruption when parsed by the affected library. An attacker who convinces a user to open a specially crafted file can crash the application, read sensitive process memory, or execute arbitrary code in the context of the current user.

The issue is tracked under [CWE-122] (Heap-based Buffer Overflow) and [CWE-787] (Out-of-bounds Write). Autodesk has published guidance in Autodesk Security Advisory ADSK-SA-2024-0010.

Critical Impact
Successful exploitation yields arbitrary code execution with the privileges of the user running AutoCAD, enabling downstream lateral movement or credential theft on engineering workstations.

Affected Products

Autodesk AutoCAD and AutoCAD Architecture
Autodesk AutoCAD Electrical, Mechanical, MEP, Map 3D, and Plant 3D
Autodesk Civil 3D and Advance Steel

Discovery Timeline

2024-06-25 - CVE-2024-23154 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23154

Vulnerability Analysis

The vulnerability resides in ODXSW_DLL.dll, a translator library shipped with Autodesk products to import SolidWorks SLDPRT geometry files. When the library parses a malformed SLDPRT structure, it writes beyond the bounds of a heap-allocated buffer. This out-of-bounds write corrupts adjacent heap metadata or object pointers.

Exploitation requires local file interaction. The attacker must deliver a crafted SLDPRT file and convince the user to open it in an affected Autodesk application. The scope remains within the process context, but code execution inherits the user's privileges, which on engineering workstations frequently include access to sensitive design intellectual property.

Root Cause

The root cause is insufficient bounds validation on data fields read from the SLDPRT file before they are copied into a fixed-size heap buffer. Attacker-controlled length or index values drive the write past the allocation boundary, producing a classic [CWE-122] heap corruption pattern.

Attack Vector

Delivery typically occurs through phishing emails, malicious file shares, or third-party CAD asset repositories. Because SLDPRT files are routinely exchanged between engineering teams and suppliers, the file type is unlikely to raise user suspicion. Refer to the Autodesk Security Advisory ADSK-SA-2024-0010 for detailed exploitation prerequisites.

No public proof-of-concept or in-the-wild exploitation has been documented for this CVE.

Detection Methods for CVE-2024-23154

Indicators of Compromise

Unexpected crashes of acad.exe or related Autodesk processes with faulting module ODXSW_DLL.dll.
SLDPRT files arriving from untrusted email senders or external file-sharing links.
Child processes spawned by AutoCAD such as cmd.exe, powershell.exe, or rundll32.exe shortly after a file open.

Detection Strategies

Monitor Windows Error Reporting and application crash telemetry for exceptions in ODXSW_DLL.dll.
Alert on AutoCAD or Civil 3D processes performing network connections, credential access, or persistence writes.
Inspect email and web gateway logs for inbound SLDPRT attachments from unverified sources.

Monitoring Recommendations

Enable command-line and process-creation auditing on engineering endpoints to capture post-exploitation activity.
Baseline normal parent-child relationships for Autodesk applications and flag deviations.
Correlate file-open events with subsequent process launches to detect exploitation attempts in near real time.

How to Mitigate CVE-2024-23154

Immediate Actions Required

Apply the fixed AutoCAD 2024, 2023, 2022, and 2021 update releases identified in the Autodesk advisory.
Restrict opening of SLDPRT files to trusted internal sources and validated vendor channels.
Enforce least privilege on engineering workstations so exploitation does not yield administrator access.

Patch Information

Autodesk has released updated versions of AutoCAD and its verticals that remediate the ODXSW_DLL.dll parsing flaw. Consult Autodesk Security Advisory ADSK-SA-2024-0010 for the fixed build numbers per product line and apply them through the Autodesk Access installer or enterprise deployment tooling.

Workarounds

Block inbound SLDPRT attachments at the email gateway until patching is complete.
Use file-type allowlisting on shared drives to prevent unreviewed CAD content from reaching engineers.
Open untrusted CAD files only inside an isolated virtual machine with no network access.

bash

# Example: block SLDPRT attachments at an Exchange transport rule (PowerShell)
New-TransportRule -Name "Block-SLDPRT-Attachments" \
  -AttachmentExtensionMatchesWords "sldprt" \
  -RejectMessageReasonText "SLDPRT files are quarantined pending CVE-2024-23154 remediation."