CVE-2024-23158 Overview
CVE-2024-23158 is a use-after-free vulnerability [CWE-416] in the ASMImport229A.dll component used by multiple Autodesk applications. The flaw is triggered when a maliciously crafted Initial Graphics Exchange Specification (IGES) file is parsed by an affected Autodesk product. Attackers can leverage the condition to crash the application or execute arbitrary code in the context of the current user process. Exploitation requires user interaction, typically opening a weaponized IGES file delivered through phishing, shared project repositories, or supply-chain channels common to engineering environments.
Critical Impact
Successful exploitation allows arbitrary code execution in the context of the AutoCAD user, enabling attackers to steal design data, pivot inside engineering networks, or deploy follow-on malware on workstations.
Affected Products
- Autodesk AutoCAD and AutoCAD Architecture, Electrical, Mechanical, MEP, Map 3D, Plant 3D
- Autodesk Civil 3D and Advance Steel
- Any Autodesk application loading the vulnerable ASMImport229A.dll IGES parser
Discovery Timeline
- 2024-06-25 - CVE-2024-23158 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-23158
Vulnerability Analysis
The vulnerability resides in ASMImport229A.dll, the shared library that Autodesk applications use to import IGES geometry files. During parsing of specially crafted IGES structures, the library references heap memory after it has already been freed. When the freed allocation is later reused for attacker-controlled data, dereferencing the stale pointer can redirect program control flow. The vulnerable code path executes under the privileges of the local Autodesk user, which typically includes access to design intellectual property, cached credentials, and network shares connected to CAD workflows.
Root Cause
The defect is a classic use-after-free condition tracked under [CWE-416]. The IGES parser releases an internal object during entity processing but retains a pointer that is later dereferenced without validation. Attackers can shape the heap by embedding crafted entities in the IGES file so that the reused allocation contains attacker-controlled fields, including virtual table pointers.
Attack Vector
Exploitation is local and requires user interaction: a victim must open the malicious IGES file in an affected Autodesk product. The IGES file may be delivered by email, downloaded from a project collaboration platform, or embedded in a compromised drawing package. No elevated privileges are required prior to exploitation, and successful code execution runs in the user's security context.
No verified public proof-of-concept is currently referenced in the enriched data. See the Autodesk Security Advisory ADSK-SA-2024-0010 for technical details.
Detection Methods for CVE-2024-23158
Indicators of Compromise
- Unexpected crashes of acad.exe or other Autodesk executables shortly after opening .igs or .iges files
- Windows Error Reporting entries citing ASMImport229A.dll as the faulting module
- IGES files arriving from untrusted senders or unusual project repositories
- Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned from an AutoCAD parent process
Detection Strategies
- Alert on AutoCAD or related Autodesk processes launching command interpreters or scripting engines
- Hunt for outbound network connections initiated by acad.exe immediately following IGES file access
- Correlate file-open telemetry for .iges/.igs extensions with subsequent process anomalies
Monitoring Recommendations
- Ingest EDR process, file, and module-load events from all engineering workstations into a central data lake
- Track loads of ASMImport229A.dll and correlate with crash telemetry
- Monitor email and file-sharing gateways for IGES attachments originating outside trusted partners
How to Mitigate CVE-2024-23158
Immediate Actions Required
- Apply the fixed versions listed in the Autodesk Security Advisory ADSK-SA-2024-0010 across all affected AutoCAD-family installations
- Restrict IGES imports to files originating from vetted internal or partner sources
- Educate CAD users on the risk of opening unsolicited .iges or .igs files
Patch Information
Autodesk released updated versions of AutoCAD, AutoCAD Architecture, Electrical, Mechanical, MEP, Map 3D, Plant 3D, Civil 3D, and Advance Steel that remediate the use-after-free in ASMImport229A.dll. Refer to the Autodesk Security Advisory ADSK-SA-2024-0010 for the specific fixed builds and download locations.
Workarounds
- Block or quarantine IGES attachments at email and web gateways until patching completes
- Run Autodesk applications as a standard user without local administrator rights to limit blast radius
- Enable Windows Defender Exploit Guard or equivalent mitigations (DEP, ASLR, CFG) on Autodesk executables
- Isolate legacy or unpatched engineering workstations on segmented network zones with restricted egress
# Example: block inbound IGES attachments at an Exchange transport rule
New-TransportRule -Name "Block-IGES-Attachments" \
-AttachmentExtensionMatchesWords "iges","igs" \
-RejectMessageReasonText "IGES attachments are blocked pending CVE-2024-23158 remediation."
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
