CVE-2024-23159: Autodesk AutoCAD RCE Vulnerability

CVE-2024-23159 Overview

CVE-2024-23159 affects multiple Autodesk products that parse STEP (STP) CAD files through the stp_aim_x64_vc15d.dll component. A maliciously crafted STP file triggers use of uninitialized variables during parsing. Attackers can combine this flaw with other vulnerabilities to achieve code execution in the context of the current process. Exploitation requires local access and user interaction, typically opening a weaponized STP file. The vulnerability is tracked under [CWE-457] Use of Uninitialized Variable and [CWE-908] Use of Uninitialized Resource. Autodesk assigned this issue high severity across its AutoCAD family and related engineering suites.

Critical Impact
Successful exploitation results in arbitrary code execution within the AutoCAD process, giving attackers the same privileges as the user running the affected application.

Affected Products

Autodesk AutoCAD, AutoCAD Architecture, AutoCAD Electrical
Autodesk AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP
Autodesk AutoCAD Plant 3D, Civil 3D, and Advance Steel

Discovery Timeline

2024-06-25 - CVE-2024-23159 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23159

Vulnerability Analysis

The flaw resides in stp_aim_x64_vc15d.dll, the module Autodesk applications use to parse STEP (.stp) CAD interchange files. During parsing of a specifically crafted STP file, the library reads variables that were never initialized to a known value. The resulting undefined data flows into subsequent logic such as pointer arithmetic, object dispatch, or memory allocation sizes. On its own, uninitialized memory use produces unreliable state, but the Autodesk advisory notes the issue can be chained with other vulnerabilities to reach arbitrary code execution. Attack complexity is low, but exploitation is bounded by the requirement that a local user open the malicious file inside an affected Autodesk product.

Root Cause

The root cause is a missing initialization path inside the STP parsing routines shipped in stp_aim_x64_vc15d.dll. Structures used to represent STEP geometry entities are allocated but not fully zeroed or populated before use, exposing stale stack or heap contents. This behavior maps to [CWE-457] Use of Uninitialized Variable and [CWE-908] Use of Uninitialized Resource.

Attack Vector

An attacker delivers a crafted STP file through email, shared network drives, project collaboration platforms, or supply-chain distribution of CAD assets. When a user opens the file with a vulnerable Autodesk product, the parser processes attacker-controlled STEP entities and dereferences uninitialized state. When combined with a companion vulnerability, this primitive lets the attacker steer execution and run code as the AutoCAD user.

No public proof-of-concept or exploit code is currently available for CVE-2024-23159, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. For technical specifics, refer to the Autodesk Security Advisory ADSK-SA-2024-0010.

Detection Methods for CVE-2024-23159

Indicators of Compromise

Unexpected child processes spawned by acad.exe or related Autodesk executables shortly after an STP file is opened.
Crashes or anomalous exceptions in stp_aim_x64_vc15d.dll recorded in Windows Error Reporting (WER).
STP files arriving from untrusted sources with abnormally large or malformed STEP entities.

Detection Strategies

Monitor process lineage where AutoCAD or related engineering tools launch cmd.exe, powershell.exe, or script interpreters.
Alert on module load events for stp_aim_x64_vc15d.dll followed by memory allocation anomalies or heap corruption indicators.
Inspect file-open telemetry for .stp and .step files originating from email attachments or web downloads before user execution.

Monitoring Recommendations

Enable Windows Defender Exploit Guard logging and forward events to a centralized SIEM for correlation with CAD workstation activity.
Track application crash dumps on engineering endpoints and triage repeated faults in Autodesk parsing libraries.
Maintain an inventory of CAD workstations and their installed Autodesk versions to prioritize alert routing.

How to Mitigate CVE-2024-23159

Immediate Actions Required

Apply Autodesk-provided updates for all installations of AutoCAD, AutoCAD verticals, Civil 3D, and Advance Steel as identified in the vendor advisory.
Restrict opening of STP files to those originating from trusted CAD partners and validated internal repositories.
Educate engineering users to treat unsolicited .stp and .step attachments as high-risk file types.

Patch Information

Autodesk has issued fixed versions for the affected products. Refer to the Autodesk Security Advisory ADSK-SA-2024-0010 for the specific fixed builds mapped to each product line. Upgrade all affected engineering workstations to the patched releases and confirm the version of stp_aim_x64_vc15d.dll matches the vendor-supplied baseline.

Workarounds

Block inbound .stp and .step files at email and web gateways for users who do not require external CAD interchange.
Enforce application allowlisting so only signed, patched Autodesk binaries can execute on CAD workstations.
Run Autodesk applications under standard user accounts to limit the impact of code execution to the current user context.

bash

# Configuration example: block STP attachments at Exchange transport rule (PowerShell)
New-TransportRule -Name "Block-STP-Attachments" \
  -AttachmentExtensionMatchesWords "stp","step" \
  -RejectMessageReasonText "STP/STEP attachments are blocked pending review."