CVE-2024-37000 Overview
CVE-2024-37000 is an out-of-bounds write vulnerability [CWE-787] in the pskernel.DLL component used by multiple Autodesk applications. A maliciously crafted X_B file triggers a write access violation when parsed by the affected library. Autodesk documents the issue in its Security Advisory ADSK-SA-2024-0009.
Exploitation requires local file access and user interaction, such as opening a weaponized X_B file inside AutoCAD or a related product. When chained with other flaws, the memory corruption can lead to arbitrary code execution in the context of the current process.
Critical Impact
Successful exploitation enables code execution in the user's process context, giving attackers full read, write, and execution rights on the victim's data.
Affected Products
- Autodesk AutoCAD and vertical products (Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D)
- Autodesk Civil 3D
- Autodesk Advance Steel
Discovery Timeline
- 2024-06-25 - CVE-2024-37000 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37000
Vulnerability Analysis
The defect resides in pskernel.DLL, the Parasolid geometric modeling kernel bundled with Autodesk products. When the library parses a specially crafted X_B file (the Parasolid binary body format), it writes data outside the bounds of an allocated buffer. This out-of-bounds write [CWE-787] corrupts adjacent memory and produces a write access violation.
Memory corruption of this class does not immediately yield code execution on its own. Autodesk explicitly notes that the flaw can be combined with additional vulnerabilities to achieve arbitrary code execution inside the AutoCAD process. The attack is local and requires the user to open the malicious file, but no elevated privileges are needed to trigger the condition.
Root Cause
The root cause is improper validation of length or offset fields inside the X_B file structure during deserialization. The parser trusts attacker-controlled sizes when copying geometry or topology records into memory. Because pskernel.DLL runs in-process with the host CAD application, corrupted memory directly influences the application's heap and control structures.
Attack Vector
An attacker delivers a weaponized X_B file through common channels: email attachments, shared engineering repositories, contractor deliverables, or supply-chain project bundles. The victim opens or imports the file inside an affected Autodesk product. Parsing occurs automatically, and the crafted structure triggers the write violation. The vulnerability does not require network access, but social engineering is effective because X_B files are routine in engineering workflows.
No public proof-of-concept is available, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. See the Autodesk Security Advisory ADSK-SA-2024-0009 for vendor technical details.
Detection Methods for CVE-2024-37000
Indicators of Compromise
- Unexpected crashes or write access violations originating from pskernel.DLL inside AutoCAD, Civil 3D, or Advance Steel processes.
- Inbound X_B (Parasolid binary) files arriving from untrusted senders or unusual project shares.
- Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned from acad.exe or related Autodesk executables shortly after opening a file.
Detection Strategies
- Monitor Windows Error Reporting and application crash telemetry for faulting module pskernel.DLL with exception code 0xC0000005 (access violation).
- Correlate file-open events for .x_b extensions with subsequent process anomalies inside CAD application sessions.
- Hunt for unsigned or suspicious modules loaded into acad.exe after X_B file parsing.
Monitoring Recommendations
- Ingest endpoint telemetry from workstations running Autodesk products and alert on abnormal child-process creation from CAD binaries.
- Track file provenance for X_B files entering engineering shares from email gateways or external collaborators.
- Review scheduled task and autorun creation events on engineering workstations following user reports of CAD crashes.
How to Mitigate CVE-2024-37000
Immediate Actions Required
- Apply the fixed versions published in the Autodesk Security Advisory ADSK-SA-2024-0009 to all affected AutoCAD, Civil 3D, and Advance Steel installations.
- Inventory endpoints running vulnerable Autodesk products and prioritize patching for users who handle third-party X_B files.
- Instruct engineering staff to avoid opening X_B files from untrusted or unverified sources until patches are deployed.
Patch Information
Autodesk released fixed builds for AutoCAD 2025, 2024, 2023, and 2022 product families, including the vertical products (Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D), Civil 3D, and Advance Steel. Refer to the vendor advisory for exact fixed version numbers per product line and update through the Autodesk Access desktop client or the Autodesk Account portal.
Workarounds
- Restrict file-sharing paths so that only vetted collaborators can drop X_B files into engineering project directories.
- Enable Windows exploit protection (DEP, ASLR, CFG) for acad.exe and related Autodesk executables to raise the cost of chained exploitation.
- Use email and web gateway policies to inspect or quarantine X_B attachments from external senders pending review.
# Example: query installed AutoCAD version to identify vulnerable hosts
reg query "HKLM\SOFTWARE\Autodesk\AutoCAD" /s /v ProductName
reg query "HKLM\SOFTWARE\Autodesk\AutoCAD" /s /v Release
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
