CVE-2024-37005: Autodesk Advance Steel RCE Vulnerability

CVE-2024-37005 Overview

CVE-2024-37005 is an out-of-bounds read vulnerability [CWE-125] affecting multiple Autodesk applications. The flaw resides in pskernel.DLL, which parses Parasolid binary (X_B) model files. A maliciously crafted X_B file triggers an out-of-bounds read when opened in a vulnerable Autodesk product. An attacker can leverage the flaw to crash the application, disclose sensitive process memory, or execute arbitrary code in the context of the current user. Exploitation requires local access and user interaction, typically by opening a weaponized file. Autodesk documented the issue in security advisory ADSK-SA-2024-0009.

Critical Impact
Arbitrary code execution, information disclosure, or application crash in the context of the user who opens a crafted X_B file across AutoCAD, Civil 3D, Advance Steel, and other Autodesk products.

Affected Products

Autodesk AutoCAD and industry-specific variants: AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
Autodesk Civil 3D
Autodesk Advance Steel

Discovery Timeline

2024-06-25 - CVE-2024-37005 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37005

Vulnerability Analysis

The vulnerability lives inside pskernel.DLL, the Parasolid geometric modeling kernel loaded by Autodesk applications when they import or open X_B files. Parasolid binary files describe boundary representation (B-rep) 3D geometry using length-prefixed records and typed tokens. When pskernel.DLL parses attacker-controlled length or offset fields without adequate bounds validation, it reads past the allocated buffer. The read operation returns data from adjacent heap memory, which the parser then treats as valid geometry metadata. Depending on how the leaked data is subsequently used, the flaw can manifest as an information leak, an access violation, or a control-flow hijack primitive suitable for code execution.

Root Cause

The root cause is missing or incorrect boundary validation on structured fields within an X_B file. The parser trusts size, count, or index values embedded in the file and dereferences them without confirming they fall within the allocated buffer. This is a classic out-of-bounds read [CWE-125] rooted in improper input validation of a complex binary format.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted X_B file through email, a shared project folder, cloud storage, or an engineering collaboration workflow. When a user opens or imports the file into a vulnerable Autodesk application, pskernel.DLL parses it and triggers the out-of-bounds read. Because Autodesk products typically run in the user's security context, successful code execution grants the attacker the same privileges as the interactive user, enabling lateral movement into CAD project repositories and engineering data.

No public proof-of-concept exploit code has been released. Refer to the Autodesk Security Advisory ADSK-SA-2024-0009 for vendor-supplied technical details.

Detection Methods for CVE-2024-37005

Indicators of Compromise

Unexpected crashes or Windows Error Reporting entries referencing pskernel.DLL inside acad.exe or related Autodesk processes
X_B files arriving from untrusted senders or dropped into engineering shares outside of normal project workflows
Autodesk parent processes spawning cmd.exe, powershell.exe, or other scripting hosts shortly after opening a Parasolid file
Outbound network connections initiated by Autodesk processes to non-Autodesk infrastructure

Detection Strategies

Monitor for module load events involving pskernel.DLL followed by process termination or exception events indicative of memory corruption
Alert on child processes created by AutoCAD, Civil 3D, or Advance Steel executables, since legitimate use rarely spawns interpreters or shells
Inspect file provenance for .x_b files in email gateways and file-sharing platforms, flagging externally sourced samples for review

Monitoring Recommendations

Enable and centralize Windows Error Reporting and application crash telemetry from engineering workstations
Baseline typical Autodesk process behavior, including expected child processes and network destinations, then alert on deviations
Track file open events for X_B extensions and correlate with subsequent process anomalies within a short time window

How to Mitigate CVE-2024-37005

Immediate Actions Required

Apply the patched versions of AutoCAD, Civil 3D, Advance Steel, and all listed AutoCAD verticals as identified in ADSK-SA-2024-0009
Inventory endpoints running Autodesk products and prioritize workstations that regularly import third-party or vendor-supplied X_B files
Instruct engineering and design teams to avoid opening Parasolid files received from unverified sources until patches are deployed

Patch Information

Autodesk released fixed builds for the affected product families. Consult the Autodesk Security Advisory ADSK-SA-2024-0009 for the specific fixed versions per product and platform, then update through the Autodesk Access installer or enterprise deployment tooling.

Workarounds

Restrict opening of X_B files to a segregated review workstation until patching is complete
Use application allowlisting to prevent Autodesk processes from launching interpreters or unsigned binaries
Apply attack surface reduction rules and least-privilege user accounts so a successful exploit is confined to the user context
Scan inbound engineering file transfers at the mail and file-sharing gateway and quarantine untrusted .x_b attachments

bash

# Example: query installed Autodesk products on Windows endpoints
# to identify hosts requiring the ADSK-SA-2024-0009 update
wmic product where "Vendor like 'Autodesk%%'" get Name,Version,InstallDate