CVE-2024-37002 Overview
CVE-2024-37002 is an uninitialized variable vulnerability affecting Autodesk AutoCAD and related products. A maliciously crafted MODEL file, when parsed by ASMkern229A.dll through Autodesk applications, triggers use of uninitialized memory. Combined with other flaws, this condition can lead to code execution in the context of the current process.
The vulnerability is categorized under [CWE-457] Use of Uninitialized Variable and [CWE-908] Use of Uninitialized Resource. Exploitation requires local access and user interaction, typically by convincing a user to open a malicious MODEL file.
Critical Impact
Successful exploitation allows arbitrary code execution in the AutoCAD process context, potentially compromising engineering workstations and intellectual property.
Affected Products
- Autodesk AutoCAD and AutoCAD Architecture
- Autodesk AutoCAD Electrical, Mechanical, MEP, Map 3D, and Plant 3D
- Autodesk Civil 3D and Advance Steel
Discovery Timeline
- 2024-06-25 - CVE-2024-37002 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37002
Vulnerability Analysis
The flaw resides in ASMkern229A.dll, a component of the ACIS-based modeling kernel used by Autodesk applications to parse geometric MODEL files. When the parser processes a maliciously crafted MODEL file, one or more variables are consumed before being properly initialized.
Use of uninitialized memory produces undefined program state. Attackers who control adjacent memory contents or influence stack/heap layout can steer this state toward attacker-controlled values. When combined with other memory corruption primitives, this enables code execution within the AutoCAD process.
The attack surface is local because MODEL files must be delivered to the target workstation and opened by an authenticated user. However, MODEL files are routinely exchanged between engineering teams, contractors, and suppliers, making social engineering a viable delivery path.
Root Cause
The root cause is failure to initialize variables or memory regions before use during MODEL file parsing in ASMkern229A.dll. Weaknesses [CWE-457] and [CWE-908] identify code paths where parser state depends on values that were never assigned an initial value.
Attack Vector
An attacker crafts a MODEL file that triggers the uninitialized read path in ASMkern229A.dll. The file is delivered via email, shared network locations, project collaboration platforms, or supplier drops. When a user opens the file in a vulnerable Autodesk product, the parser dereferences the uninitialized value, enabling attacker-controlled behavior and, chained with other primitives, code execution.
No verified proof-of-concept has been published for CVE-2024-37002. Refer to the Autodesk Security Advisory ADSK-SA-2024-0009 for vendor technical details.
Detection Methods for CVE-2024-37002
Indicators of Compromise
- Unexpected crashes, hangs, or memory access violations in acad.exe or ASMkern229A.dll following the opening of a MODEL file.
- MODEL, .sat, .sab, or related ACIS-format files arriving from untrusted external sources or unusual senders.
- Child processes spawned by AutoCAD executables that are inconsistent with normal engineering workflows, such as cmd.exe, powershell.exe, or rundll32.exe.
- Outbound network connections from AutoCAD processes to unknown external hosts shortly after file open events.
Detection Strategies
- Monitor process creation events where the parent is an Autodesk application and the child is a shell, script interpreter, or LOLBin.
- Correlate file-open telemetry for MODEL and ACIS file formats with subsequent process anomalies on the same host.
- Apply YARA or content-inspection rules at email and file gateways for suspicious ACIS/MODEL structures received from external sources.
Monitoring Recommendations
- Enable module-load auditing to track ASMkern229A.dll load events and correlate with parsing crashes reported by Windows Error Reporting.
- Collect and centralize AutoCAD process telemetry (process creation, module loads, network connections) in a SIEM for retrospective hunting.
- Alert on Autodesk applications making outbound connections outside of licensing and update endpoints.
How to Mitigate CVE-2024-37002
Immediate Actions Required
- Apply the fixed versions listed in Autodesk Security Advisory ADSK-SA-2024-0009 across all affected products.
- Inventory endpoints running AutoCAD, AutoCAD verticals, Civil 3D, and Advance Steel to confirm patch status.
- Restrict opening MODEL files received from external or untrusted sources until patches are deployed.
- Enforce least privilege on engineering workstations so AutoCAD does not run with administrative rights.
Patch Information
Autodesk has released updated versions of the affected products. Consult the vendor advisory ADSK-SA-2024-0009 for the specific fixed release numbers per product line and apply them through the Autodesk Access desktop client or enterprise deployment tooling.
Workarounds
- Block inbound MODEL, .sat, and .sab file attachments at the email gateway pending patching.
- Use application allowlisting to prevent Autodesk processes from spawning script interpreters and shells.
- Segment engineering workstations from sensitive network zones to limit post-exploitation reach.
- Train users to validate the source of CAD files before opening, especially files delivered by external parties.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
