CVE-2024-37003 Overview
CVE-2024-37003 is a stack-based buffer overflow vulnerability affecting multiple Autodesk applications. The flaw resides in the opennurbs.dll and ODXSW_DLL.dll libraries when parsing maliciously crafted DWG and SLDPRT files. An attacker who convinces a user to open a specially crafted file can trigger a crash, read sensitive process memory, or execute arbitrary code in the context of the current process. The vulnerability is tracked under [CWE-121] Stack-based Buffer Overflow and [CWE-787] Out-of-bounds Write. Autodesk published guidance in Autodesk Security Advisory ADSK-SA-2024-0009.
Critical Impact
Arbitrary code execution in the context of the AutoCAD process via a malicious DWG or SLDPRT file, requiring only local user interaction.
Affected Products
- Autodesk AutoCAD and AutoCAD Architecture, Electrical, Map 3D, Mechanical, MEP, and Plant 3D
- Autodesk Civil 3D
- Autodesk Advance Steel
Discovery Timeline
- 2024-06-25 - CVE-2024-37003 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37003
Vulnerability Analysis
The vulnerability is a stack-based buffer overflow ([CWE-121]) triggered during file parsing operations inside opennurbs.dll and ODXSW_DLL.dll. These libraries handle geometry and 3D model data for DWG (AutoCAD drawing) and SLDPRT (SolidWorks part) files. When Autodesk applications open a crafted file, malformed structures cause the parsers to write past the bounds of a stack-allocated buffer ([CWE-787]).
Successful exploitation grants full read, write, and execute effects on process memory. An attacker can corrupt return addresses or structured exception handler records to hijack execution flow. Because the affected products run with the privileges of the invoking user, code executes in that user context. Impacts include process crashes, disclosure of memory contents, and arbitrary code execution.
Root Cause
The root cause is inadequate bounds validation during deserialization of geometry records in the OpenNURBS library and its Autodesk companion ODXSW_DLL.dll. Attacker-controlled length or index fields inside DWG and SLDPRT structures are trusted without validation, allowing a copy operation to exceed the destination stack buffer.
Attack Vector
Exploitation requires a local user to open a malicious file in a vulnerable Autodesk application. Attackers typically deliver the payload via phishing email, shared network drives, collaboration platforms, or supply-chain injection into engineering project repositories. No elevated privileges are required prior to exploitation, and the resulting code runs at the level of the current user.
No verified exploit code is publicly available. See Autodesk Security Advisory ADSK-SA-2024-0009 for vendor details.
Detection Methods for CVE-2024-37003
Indicators of Compromise
- Unexpected crashes or Windows Error Reporting events referencing opennurbs.dll or ODXSW_DLL.dll in Autodesk processes such as acad.exe.
- DWG or SLDPRT files arriving from untrusted sources, especially through email attachments or unmanaged file shares.
- Child processes spawned by AutoCAD or related Autodesk binaries (for example cmd.exe, powershell.exe, or rundll32.exe) shortly after a file is opened.
Detection Strategies
- Monitor endpoint telemetry for anomalous process behavior originating from Autodesk executables, including memory access violations and shellcode-like execution patterns.
- Deploy YARA rules targeting malformed OpenNURBS records and abnormal DWG or SLDPRT structural fields inspected at email and file-sharing gateways.
- Correlate crash telemetry with file-open events to identify parser exploitation attempts against opennurbs.dll.
Monitoring Recommendations
- Enable Windows Error Reporting and forward .dmp metadata to a central log store for review of faulting modules in Autodesk processes.
- Track file-write events that place DWG or SLDPRT content into user download or temporary folders, then correlate with subsequent AutoCAD launches.
- Alert on outbound network connections initiated by acad.exe or related Autodesk processes that deviate from documented product behavior.
How to Mitigate CVE-2024-37003
Immediate Actions Required
- Apply the fixed builds listed in Autodesk Security Advisory ADSK-SA-2024-0009 for every affected AutoCAD, Civil 3D, and Advance Steel installation.
- Inventory endpoints running Autodesk software and prioritize patching engineering and CAD workstations that regularly ingest external files.
- Instruct users to open DWG and SLDPRT files only from verified sources and to report unexpected crashes to security teams.
Patch Information
Autodesk released updated versions of AutoCAD and the affected verticals (AutoCAD Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D), Civil 3D, and Advance Steel that remediate the parsing flaw in opennurbs.dll and ODXSW_DLL.dll. Refer to Autodesk Security Advisory ADSK-SA-2024-0009 for exact fixed version numbers per product family.
Workarounds
- Restrict opening of DWG and SLDPRT files to those obtained from trusted internal repositories with integrity controls.
- Block or quarantine DWG and SLDPRT attachments from external senders at the email gateway pending user verification.
- Enforce least-privilege on CAD workstations so that any exploitation runs without administrative rights, reducing follow-on impact.
# Example: block DWG and SLDPRT attachments at an Exchange transport rule (PowerShell)
New-TransportRule -Name "Block-DWG-SLDPRT-External" \
-FromScope NotInOrganization \
-AttachmentExtensionMatchesWords "dwg","sldprt" \
-RejectMessageReasonText "External CAD attachments are blocked pending review (CVE-2024-37003)."
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
