CVE-2024-37004 Overview
CVE-2024-37004 is a use-after-free vulnerability [CWE-416] in the ASMKERN229A.dll component used by Autodesk AutoCAD and related products. A maliciously crafted SLDPRT (SolidWorks Part) file triggers the flaw when parsed through affected Autodesk applications. Successful exploitation can lead to arbitrary code execution in the context of the current process. The vulnerability requires local user interaction, typically opening a malicious file, and impacts confidentiality, integrity, and availability.
Critical Impact
A crafted SLDPRT file processed by ASMKERN229A.dll can trigger a use-after-free condition, enabling code execution within the AutoCAD process context.
Affected Products
- Autodesk AutoCAD and AutoCAD Architecture
- Autodesk AutoCAD Electrical, Map 3D, Mechanical, MEP, and Plant 3D
- Autodesk Civil 3D and Advance Steel
Discovery Timeline
- 2024-06-25 - CVE-2024-37004 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37004
Vulnerability Analysis
The vulnerability resides in ASMKERN229A.dll, a modeling kernel library shared across the Autodesk product family. When the library parses a specially crafted SLDPRT file, it dereferences memory that has already been freed. This use-after-free condition [CWE-416] allows an attacker to influence the contents of the reclaimed memory region.
By controlling the freed object's replacement contents, an attacker can hijack control flow when the dangling pointer is later dereferenced. Autodesk categorizes the issue as chainable with other flaws to achieve code execution in the current process. Exploitation occurs locally with user interaction, requiring the victim to open the malicious file in an affected application.
Root Cause
The root cause is improper lifetime management of an object handled by ASMKERN229A.dll during SLDPRT parsing. The parser retains a reference to an object after it has been released, then reuses that pointer without validation. Autodesk's advisory attributes the issue to memory handling within the shared modeling kernel component.
Attack Vector
An attacker delivers a weaponized SLDPRT file through email, shared drives, or supply-chain channels frequented by CAD engineers. When a user opens or imports the file into AutoCAD, AutoCAD Mechanical, Civil 3D, or another affected product, ASMKERN229A.dll processes the malformed geometry data. The dangling pointer is reused during subsequent parsing operations, allowing attacker-controlled data to be treated as a valid object.
The vulnerability manifests during file parsing in the modeling kernel. See the Autodesk Security Advisory ADSK-SA-2024-0009 for vendor technical details and fixed builds.
Detection Methods for CVE-2024-37004
Indicators of Compromise
- Unexpected crashes of acad.exe or related Autodesk processes shortly after opening SLDPRT files from untrusted sources.
- Child processes spawned by AutoCAD such as cmd.exe, powershell.exe, or rundll32.exe following SLDPRT import operations.
- SLDPRT files delivered through email attachments, USB media, or unauthorized file shares that target engineering workstations.
Detection Strategies
- Monitor process creation events where AutoCAD or related Autodesk binaries spawn scripting hosts or shell interpreters.
- Flag file open operations for SLDPRT files originating outside sanctioned engineering repositories.
- Correlate module loads of ASMKERN229A.dll with subsequent access violations recorded in Windows Application event logs.
Monitoring Recommendations
- Enable Windows Error Reporting collection to identify crash signatures involving ASMKERN229A.dll.
- Track version inventories of AutoCAD installations to identify hosts running builds prior to the fixed release.
- Alert on SLDPRT file transfers between segmented networks or from external collaboration platforms into engineering environments.
How to Mitigate CVE-2024-37004
Immediate Actions Required
- Apply the fixed Autodesk product updates listed in advisory ADSK-SA-2024-0009 to all affected installations.
- Restrict opening of SLDPRT files to those received from trusted, verified engineering partners.
- Inventory endpoints running AutoCAD, Civil 3D, Advance Steel, and the AutoCAD verticals to confirm patch coverage.
Patch Information
Autodesk released updated builds addressing the use-after-free condition in ASMKERN229A.dll. Refer to the Autodesk Security Advisory ADSK-SA-2024-0009 for the specific fixed versions per product line and download instructions.
Workarounds
- Block inbound SLDPRT attachments at the email gateway until affected workstations are patched.
- Enforce application allowlisting to prevent AutoCAD from launching scripting hosts or unsigned child processes.
- Isolate engineering workstations that cannot be immediately updated from general corporate network traffic.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
