CVE-2024-37006 Overview
CVE-2024-37006 is an out-of-bounds write vulnerability [CWE-787] in the CC5Dll.dll component used by Autodesk AutoCAD and related products. A maliciously crafted CATPRODUCT file triggers a write access violation when parsed by the vulnerable library. Attackers can chain this memory corruption with other flaws to execute code in the context of the running Autodesk process. Exploitation requires local access and user interaction, typically convincing a user to open a weaponized CAD file.
Critical Impact
Successful exploitation can lead to arbitrary code execution in the context of the current Autodesk process, resulting in full compromise of the user's session and access to sensitive engineering data.
Affected Products
- Autodesk AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D
- Autodesk AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
- Autodesk Civil 3D and Advance Steel
Discovery Timeline
- 2024-06-25 - CVE-2024-37006 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-37006
Vulnerability Analysis
The vulnerability resides in CC5Dll.dll, a library Autodesk applications load to parse CATIA CATPRODUCT assembly files. When the parser processes attacker-controlled fields inside a crafted CATPRODUCT, it performs a write beyond the bounds of an allocated buffer. This out-of-bounds write [CWE-787] corrupts adjacent memory structures.
On its own, the flaw produces a write access violation and typically crashes the process. Combined with additional primitives, such as an information disclosure or a controlled pointer overwrite, an attacker can convert the corruption into arbitrary code execution within the Autodesk process. Because AutoCAD frequently runs with the interactive user's privileges, code execution grants access to any resources that user can reach, including local files, network shares, and design intellectual property.
Root Cause
The root cause is insufficient validation of size or index fields inside the CATPRODUCT file format. The parser trusts attacker-supplied structural metadata when computing write offsets or copy lengths. This trust boundary violation allows a crafted file to steer writes outside the intended buffer.
Attack Vector
Exploitation requires local access with user interaction. An attacker delivers a weaponized CATPRODUCT file through email, a shared drive, a project collaboration platform, or a supply chain compromise. When the user opens the file in a vulnerable Autodesk product, CC5Dll.dll parses the malicious content and triggers the out-of-bounds write. No network exposure is required. See the Autodesk Security Advisory ADSK-SA-2024-0009 for parser-specific details.
No verified public exploit code is available for CVE-2024-37006.
See the Autodesk security advisory for parser-specific technical details.
Detection Methods for CVE-2024-37006
Indicators of Compromise
- Unexpected crashes of acad.exe or related Autodesk processes with access violation exceptions referencing CC5Dll.dll.
- CATPRODUCT files arriving from untrusted sources or appearing in user download and temp directories.
- Child processes spawned from AutoCAD such as cmd.exe, powershell.exe, or rundll32.exe shortly after opening a CAD file.
Detection Strategies
- Hunt for process ancestry where Autodesk applications spawn scripting interpreters, LOLBins, or network utilities.
- Correlate Windows Error Reporting entries for acad.exe faulting in CC5Dll.dll with recent file open events.
- Inspect CATPRODUCT files with format-aware tooling to flag structural anomalies before users open them.
Monitoring Recommendations
- Enable command line and process creation logging (Event ID 4688 with command line auditing, or Sysmon Event ID 1) on engineering workstations.
- Alert on outbound network connections initiated directly by Autodesk processes, which are unusual during normal editing.
- Monitor file system events for CATPRODUCT files written to user directories from mail clients, browsers, or removable media.
How to Mitigate CVE-2024-37006
Immediate Actions Required
- Apply the fixed versions listed in the Autodesk Security Advisory ADSK-SA-2024-0009 to every affected AutoCAD, Civil 3D, and Advance Steel installation.
- Instruct CAD users to open CATPRODUCT files only when the origin is verified and expected.
- Inventory endpoints running affected Autodesk products and prioritize patching for workstations with access to sensitive design repositories.
Patch Information
Autodesk released updated builds for AutoCAD 2025, 2024, 2023, and 2022 product families addressing this parser flaw. Refer to the vendor advisory for the exact fixed version per product line and download links through the Autodesk Account portal.
Workarounds
- Restrict CAD workstations from executing scripting interpreters and unsigned binaries where operationally feasible.
- Run Autodesk applications under standard user accounts, never with local administrator rights.
- Block or quarantine inbound CATPRODUCT attachments at the email gateway until all endpoints are patched.
# Locate installed Autodesk products and versions on Windows for patch tracking
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object { $_.Publisher -like "*Autodesk*" } |
Select-Object DisplayName, DisplayVersion, InstallLocation |
Sort-Object DisplayName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
