CVE-2024-37001: Autodesk AutoCAD Buffer Overflow Flaw

CVE-2024-37001 Overview

CVE-2024-37001 is a heap-based buffer overflow vulnerability in the opennurbs.dll component used by multiple Autodesk applications. A maliciously crafted 3DM file, when parsed by an affected Autodesk product, triggers memory corruption on the heap. An attacker can leverage this flaw to crash the application, disclose sensitive process memory, or execute arbitrary code in the context of the current user. The vulnerability is tracked under [CWE-122] (Heap-based Buffer Overflow) and [CWE-787] (Out-of-bounds Write). Exploitation requires the victim to open an attacker-supplied 3DM file, making it a client-side attack suitable for spear-phishing and supply-chain scenarios targeting engineering workstations.

Critical Impact
Successful exploitation results in arbitrary code execution within the Autodesk application process, enabling attackers to compromise engineering workstations that handle 3DM CAD assets.

Affected Products

Autodesk AutoCAD and AutoCAD Architecture
Autodesk AutoCAD Electrical, Mechanical, MEP, Map 3D, and Plant 3D
Autodesk Civil 3D and Advance Steel

Discovery Timeline

2024-06-25 - CVE-2024-37001 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37001

Vulnerability Analysis

The flaw resides in opennurbs.dll, the Autodesk-maintained library responsible for parsing OpenNURBS-formatted 3DM files. 3DM is the native geometry interchange format used by Rhino and Autodesk applications to represent NURBS surfaces, meshes, and CAD metadata. The parser fails to properly validate length or offset fields embedded in a 3DM chunk before copying data into a heap-allocated buffer. An attacker who controls the file contents can force the parser to write past the end of an allocated heap region.

The corruption occurs during document load, so no additional user interaction beyond opening the file is required. Because Autodesk applications typically run with the interactive user's privileges, code execution inherits the token of the logged-in engineer or designer.

Root Cause

The root cause is inadequate bounds checking during deserialization of 3DM chunk structures inside opennurbs.dll. Attacker-controlled size fields determine the length of a subsequent memcpy-style operation into a fixed or undersized heap buffer, producing an out-of-bounds write ([CWE-787]) on the heap ([CWE-122]).

Attack Vector

Exploitation requires local file parsing with user interaction: the victim must open a malicious 3DM file, or a project that references one, in an affected Autodesk product. Delivery channels include phishing emails with 3DM attachments, watering-hole downloads on CAD community sites, and compromised third-party asset libraries. Once the file is opened, the parser executes attacker-controlled corruption primitives that can be shaped into arbitrary code execution using standard heap-grooming techniques against the Windows heap allocator.

No verified public proof-of-concept is available. See the Autodesk Security Advisory ADSK-SA-2024-0009 for vendor-published technical context.

Detection Methods for CVE-2024-37001

Indicators of Compromise

Unexpected child processes spawned by acad.exe or other Autodesk product binaries, particularly cmd.exe, powershell.exe, or rundll32.exe.
Crashes or Windows Error Reporting entries referencing opennurbs.dll following the opening of a 3DM file.
3DM files delivered from untrusted email senders, file shares, or downloaded from unverified CAD asset marketplaces.

Detection Strategies

Hunt for process-lineage anomalies where Autodesk applications launch scripting interpreters, LOLBins, or network-capable binaries shortly after file open events.
Alert on module load failures or access violations in opennurbs.dll reported via WER telemetry and EDR crash events.
Inspect recently opened file lists and MRU registry keys for 3DM files from anomalous paths such as %TEMP%, browser download directories, or removable media.

Monitoring Recommendations

Forward Windows crash telemetry and EDR process events from engineering workstations to a central SIEM for correlation with file-open activity.
Monitor outbound network connections initiated by Autodesk product processes; a CAD application beaconing to external hosts is a strong post-exploitation signal.
Track software inventory to ensure all installed Autodesk products are on patched build numbers referenced in ADSK-SA-2024-0009.

How to Mitigate CVE-2024-37001

Immediate Actions Required

Apply the patched Autodesk product versions listed in Autodesk Security Advisory ADSK-SA-2024-0009 to all engineering workstations.
Instruct users to open 3DM files only from trusted sources and to validate the sender before opening email attachments.
Restrict execution of Autodesk applications to standard user accounts to limit the blast radius of code execution.

Patch Information

Autodesk released fixed builds for AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, and Advance Steel. Consult the Autodesk Security Advisory ADSK-SA-2024-0009 for the exact patched version numbers for each product line and update through the Autodesk Access desktop client.

Workarounds

Block inbound email attachments and web downloads with the .3dm extension at the mail gateway and proxy until patching is complete.
Apply Windows Exploit Protection (formerly EMET) policies such as CFG, DEP, and ASLR enforcement to Autodesk product executables to increase exploitation cost.
Isolate CAD workstations that must process untrusted 3DM files into a segmented VLAN with restricted egress and no access to production file shares.

bash

# Example: block .3dm attachments at an Exchange transport rule
New-TransportRule -Name "Block-3DM-Attachments" \
  -AttachmentExtensionMatchesWords "3dm" \
  -RejectMessageReasonText "3DM files are blocked pending CVE-2024-37001 patching."