CVE-2024-36999: Autodesk AutoCAD Buffer Overflow Vulnerability

CVE-2024-36999 Overview

CVE-2024-36999 is an out-of-bounds write vulnerability in the opennurbs.dll component used by Autodesk AutoCAD and related products. A maliciously crafted 3DM file, when parsed by the library, forces a write past the bounds of an allocated buffer. Attackers can leverage the flaw to crash the application, corrupt sensitive data, or execute arbitrary code in the context of the running Autodesk process. Exploitation requires a user to open the malicious file locally, but the impact spans confidentiality, integrity, and availability. The vulnerability is tracked under [CWE-787] (Out-of-Bounds Write) with a secondary classification of [CWE-125] (Out-of-Bounds Read).

Critical Impact
Successful exploitation results in arbitrary code execution within the AutoCAD process, giving attackers a foothold on engineering workstations that frequently hold sensitive design intellectual property.

Affected Products

Autodesk AutoCAD and AutoCAD Architecture
Autodesk AutoCAD Electrical, Mechanical, MEP, Map 3D, and Plant 3D
Autodesk Civil 3D and Advance Steel

Discovery Timeline

2024-06-25 - CVE-2024-36999 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36999

Vulnerability Analysis

The flaw resides in opennurbs.dll, the open-source NURBS geometry library Autodesk uses to parse .3DM files. When the parser processes a crafted 3DM file, it writes data beyond the boundaries of an allocated buffer. This out-of-bounds write can overwrite adjacent memory structures such as function pointers, virtual tables, or heap metadata.

Exploitation is local and requires user interaction. A victim must open or import the malicious 3DM file, typically delivered via email attachment, shared project folder, or supply-chain modification of legitimate CAD assets. Because AutoCAD often runs with elevated privileges on engineering workstations, code execution grants attackers meaningful access to design data and lateral movement paths.

Root Cause

The root cause is insufficient bounds validation when deserializing geometry structures inside the OpenNURBS parser. The library trusts size or count fields embedded in the 3DM file when copying data into fixed or precomputed buffers. When those fields exceed the actual allocation, the write overruns adjacent memory. Refer to the Autodesk Security Advisory ADSK-SA-2024-0010 for the affected version list and technical scope.

Attack Vector

The attack vector is a weaponized .3DM file delivered to an AutoCAD user. When the user opens or imports the file, opennurbs.dll parses malformed geometry records and triggers the out-of-bounds write. Chained with heap grooming techniques, an attacker can transform the memory corruption into reliable arbitrary code execution. No detailed public proof-of-concept has been released, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-36999

Indicators of Compromise

Unexpected crashes of acad.exe or other Autodesk host processes shortly after opening a .3DM file
Windows Error Reporting (WER) entries referencing faulting module opennurbs.dll with exception code 0xC0000005
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawning from an Autodesk product
3DM files delivered from untrusted sources, external email, or unverified vendor project drops

Detection Strategies

Hunt for process-lineage anomalies where AutoCAD or Civil 3D spawns scripting or shell interpreters
Alert on opennurbs.dll faults captured in Windows crash telemetry across engineering workstations
Inspect inbound file transfers for .3DM attachments and correlate with subsequent endpoint behavior

Monitoring Recommendations

Enable command-line and image-load logging on CAD workstations to capture DLL and process activity
Forward Windows crash and application logs to a centralized data lake for retrospective hunting
Baseline normal AutoCAD child-process behavior so deviations trigger high-fidelity alerts

How to Mitigate CVE-2024-36999

Immediate Actions Required

Apply the fixed AutoCAD releases listed in Autodesk Security Advisory ADSK-SA-2024-0010
Restrict opening of .3DM files sourced from external or unverified parties until patching is complete
Enforce least-privilege on CAD workstations so exploited processes cannot escalate to SYSTEM
Educate designers and engineers about the risk of opening unsolicited CAD attachments

Patch Information

Autodesk released fixed versions of AutoCAD 2022, 2023, 2024, and 2025, along with the corresponding vertical products (Architecture, Electrical, Mechanical, MEP, Map 3D, Plant 3D, Civil 3D, and Advance Steel). Consult the Autodesk Security Advisory ADSK-SA-2024-0010 for the exact build numbers per product line, and deploy updates through the Autodesk Access installer or enterprise deployment tooling.

Workarounds

Block .3DM file ingress at email and web gateways for users who do not require external CAD collaboration
Isolate legacy AutoCAD hosts that cannot be patched using network segmentation and application allowlisting
Require CAD files from external partners to be inspected in a sandboxed environment before opening on production workstations

bash

# Example: block .3DM inbound attachments on Exchange with a transport rule
New-TransportRule -Name "Block-3DM-Attachments" \
  -AttachmentExtensionMatchesWords "3dm" \
  -RejectMessageReasonText "3DM files must be reviewed by CAD security before delivery"