CVE-2024-23156 Overview
CVE-2024-23156 is an out-of-bounds write vulnerability [CWE-787] in the opennurbs.dll and ASMkern229A.dll libraries used by Autodesk AutoCAD and related products. A maliciously crafted 3DM file triggers a memory corruption condition when parsed, resulting in a write access violation. Attackers can chain this flaw with other vulnerabilities to achieve code execution in the context of the current process. Exploitation requires a local user to open the malicious file, making phishing and social engineering the most likely delivery methods against engineering and design teams.
Critical Impact
A crafted 3DM file opened in a vulnerable Autodesk application can corrupt memory and enable arbitrary code execution with the user's privileges.
Affected Products
- Autodesk AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D
- Autodesk AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
- Autodesk Civil 3D and Advance Steel
Discovery Timeline
- 2024-06-25 - CVE-2024-23156 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-23156
Vulnerability Analysis
The vulnerability resides in the 3DM file parsing routines exported by opennurbs.dll and ASMkern229A.dll, both of which are loaded by Autodesk AutoCAD and its verticals. When these libraries process malformed structures inside a crafted 3DM model, the parser writes data outside the bounds of an allocated buffer. The out-of-bounds write [CWE-787] corrupts adjacent heap or stack memory. Attackers who control the layout of overwritten data can influence function pointers, virtual table entries, or object headers that the process later dereferences. Combined with other primitives, this leads to arbitrary code execution in the AutoCAD process, inheriting the interactive user's privileges and access to design files, network shares, and credentials.
Root Cause
The root cause is missing or insufficient bounds checking on length and offset fields inside 3DM object chunks. The openNURBS parser trusts attacker-controlled size values when copying geometry, attribute, or plugin data into memory buffers. Because 3DM is a complex binary format with nested records, a single malformed field propagates into unchecked write operations.
Attack Vector
Exploitation is local and requires user interaction. An attacker delivers the malicious .3dm file through email, a shared project folder, or a compromised design collaboration platform. When a designer opens the file in AutoCAD or a supported vertical product, the vulnerable library parses it and triggers the write access violation. No network exposure of AutoCAD is required.
No public proof-of-concept exploit is available for CVE-2024-23156. Technical details are limited to the vendor advisory. See the Autodesk Security Advisory ADSK-SA-2024-0010 for affected version ranges.
Detection Methods for CVE-2024-23156
Indicators of Compromise
- Unexpected crashes of acad.exe or child processes shortly after a .3dm file is opened, particularly with access violation exceptions referencing opennurbs.dll or ASMkern229A.dll.
- Creation of child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by acad.exe or other Autodesk executables.
- 3DM files arriving from untrusted email senders, external file shares, or web downloads outside normal project workflows.
Detection Strategies
- Monitor Windows Error Reporting (WER) and application crash telemetry for faulting modules opennurbs.dll and ASMkern229A.dll.
- Alert on anomalous process lineage where Autodesk applications spawn scripting hosts, LOLBins, or network utilities.
- Correlate file-open events for .3dm extensions with subsequent process anomalies and outbound network connections.
Monitoring Recommendations
- Ingest endpoint process, file, and crash telemetry from engineering workstations into a centralized SIEM or data lake for retrospective hunting.
- Track loaded module versions of opennurbs.dll and ASMkern229A.dll across the fleet to identify unpatched hosts.
- Baseline normal AutoCAD behavior and alert on deviations, including unexpected DLL loads and new outbound destinations.
How to Mitigate CVE-2024-23156
Immediate Actions Required
- Apply the fixed versions listed in Autodesk Security Advisory ADSK-SA-2024-0010 to all affected AutoCAD and vertical product installations.
- Inventory workstations running AutoCAD, Civil 3D, Advance Steel, and the AutoCAD verticals, and prioritize systems used by users who receive external files.
- Instruct designers to open 3DM files only from trusted internal sources until patching is complete.
Patch Information
Autodesk has released updated versions of AutoCAD and the affected vertical products that correct the parsing logic in opennurbs.dll and ASMkern229A.dll. Refer to Autodesk Security Advisory ADSK-SA-2024-0010 for the exact fixed build numbers per product line. Deploy patches through the Autodesk Access installer or existing software distribution tooling.
Workarounds
- Block or quarantine .3dm attachments at the email gateway when senders are external and not on an allowlist of design partners.
- Restrict AutoCAD execution to standard user contexts and apply application control policies that prevent AutoCAD from launching scripting hosts or command interpreters.
- Enable Attack Surface Reduction rules and exploit protection mitigations (CFG, ACG, DEP) on engineering workstations to raise the cost of exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
