CVE-2024-23157: Autodesk AutoCAD RCE Vulnerability

CVE-2024-23157 Overview

CVE-2024-23157 is an out-of-bounds write vulnerability [CWE-787] affecting multiple Autodesk AutoCAD products. A maliciously crafted SLDASM or SLDPRT file, when parsed by ODXSW_DLL.dll through Autodesk applications, triggers memory corruption via a write access violation. Attackers can chain this flaw with other vulnerabilities to achieve code execution in the context of the current process. Exploitation requires a local user to open the crafted file, aligning with the local attack vector and required user interaction reflected in the vulnerability's scoring.

Critical Impact
Successful exploitation enables arbitrary code execution in the AutoCAD process, with full impact to confidentiality, integrity, and availability on the affected host.

Affected Products

Autodesk AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D
Autodesk AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
Autodesk Civil 3D and Autodesk Advance Steel

Discovery Timeline

2024-06-25 - CVE-2024-23157 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23157

Vulnerability Analysis

The vulnerability resides in ODXSW_DLL.dll, a component used by Autodesk applications to parse SolidWorks assembly (SLDASM) and part (SLDPRT) files. When the parser processes a maliciously crafted file, it writes data outside the bounds of an allocated buffer. The resulting write access violation corrupts adjacent memory structures. An attacker who controls the corrupted memory contents can influence program flow. Autodesk notes that chaining this issue with other vulnerabilities enables code execution within the current process. The flaw is categorized under [CWE-787: Out-of-bounds Write].

Root Cause

The parser in ODXSW_DLL.dll fails to validate size or offset fields extracted from the input file before performing write operations. Untrusted values in the SLDASM or SLDPRT container drive buffer operations directly, allowing the write to extend past legitimate allocations. This class of bug is common in complex binary file parsers where nested structures reference variable-length regions.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a weaponized SLDASM or SLDPRT file via email, shared drive, project distribution, or a supply chain path. When a user opens the file in a vulnerable Autodesk product, the malformed parsing triggers the memory corruption. Because the affected process runs with the user's privileges, execution grants the attacker the same rights, enabling persistence, credential theft, or lateral movement in engineering environments.

No public proof-of-concept is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Autodesk Security Advisory ADSK-SA-2024-0010 for vendor-specific technical details.

Detection Methods for CVE-2024-23157

Indicators of Compromise

Unexpected crashes of acad.exe or related Autodesk processes when opening .sldasm or .sldprt files, particularly with access violation exceptions referencing ODXSW_DLL.dll.
Presence of unsolicited SLDASM or SLDPRT files in email attachments, downloads, or project shares from unverified sources.
Child processes spawned by AutoCAD such as cmd.exe, powershell.exe, rundll32.exe, or regsvr32.exe shortly after file open events.

Detection Strategies

Monitor Windows Error Reporting and application crash telemetry for faulting module ODXSW_DLL.dll across engineering workstations.
Alert on AutoCAD family processes creating suspicious child processes, writing to %TEMP%, or making outbound network connections.
Inspect file provenance for CAD assets to identify files originating outside approved engineering pipelines.

Monitoring Recommendations

Enable audit logging for file opens in Autodesk applications and forward events to a centralized SIEM for correlation.
Track process behavior of acad.exe, AecBase.dbx, and related binaries using EDR telemetry with focus on memory violation events and injected threads.
Correlate CAD file delivery vectors (email, cloud storage, USB) with subsequent process anomalies on the same host.

How to Mitigate CVE-2024-23157

Immediate Actions Required

Apply the patched versions listed in the Autodesk Security Advisory ADSK-SA-2024-0010 for each affected product line.
Inventory endpoints running AutoCAD, Civil 3D, Advance Steel, and the AutoCAD verticals, and prioritize patching for hosts that handle externally sourced CAD files.
Educate engineering users to avoid opening SLDASM or SLDPRT files received from untrusted senders or unverified project sources.

Patch Information

Autodesk has published fixed builds for AutoCAD 2024, AutoCAD 2023, AutoCAD 2022, and AutoCAD 2021 and their vertical products (Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D), as well as Civil 3D and Advance Steel. Consult the vendor advisory for exact fixed version numbers per product and release channel.

Workarounds

Restrict opening of SLDASM and SLDPRT files to trusted internal sources until patches are deployed across the fleet.
Use email gateway and web proxy policies to quarantine inbound SolidWorks-format attachments pending review.
Run AutoCAD under least-privilege user accounts and enforce application allowlisting to limit the impact of successful exploitation.

bash

# Example: Group Policy / PowerShell inventory to locate vulnerable Autodesk installs
Get-WmiObject -Class Win32_Product |
  Where-Object { $_.Vendor -like "*Autodesk*" } |
  Select-Object Name, Version, InstallDate |
  Sort-Object Name