CVE-2024-7305: Autodesk Advance Steel RCE Vulnerability

CVE-2024-7305 Overview

CVE-2024-7305 is an out-of-bounds write vulnerability [CWE-787] in AdDwfPdk.dll, a component used by Autodesk AutoCAD and related products to parse Design Web Format (DWF) files. A maliciously crafted DWF file triggers the memory corruption when opened in an affected Autodesk application. Attackers can leverage the flaw to cause a crash, corrupt process data, or execute arbitrary code in the context of the current user. Exploitation requires local file delivery and user interaction to open the crafted file. Autodesk published advisory ADSK-SA-2024-0014 on August 20, 2024, covering multiple products across the AutoCAD family.

Critical Impact
Successful exploitation yields arbitrary code execution in the context of the AutoCAD user, enabling malware installation, data theft, or lateral movement from engineering workstations.

Affected Products

Autodesk AutoCAD, AutoCAD LT, and DWG TrueView
Autodesk AutoCAD Architecture, Electrical, Map 3D, Mechanical, MEP, and Plant 3D
Autodesk Advance Steel and Civil 3D

Discovery Timeline

2024-08-20 - CVE-2024-7305 published to the National Vulnerability Database
2024-08-20 - Autodesk publishes security advisory ADSK-SA-2024-0014
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7305

Vulnerability Analysis

The vulnerability resides in AdDwfPdk.dll, the Autodesk DWF Publish Development Kit library that AutoCAD and derived products load to parse DWF content. Parsing a maliciously crafted DWF file causes the library to write beyond the bounds of an allocated buffer. The write occurs in the memory of the AutoCAD process and can overwrite adjacent objects, function pointers, or heap metadata. An attacker who controls the corrupted memory can steer execution toward attacker-supplied code, achieving arbitrary code execution with the privileges of the user running AutoCAD.

Root Cause

The root cause is an out-of-bounds write [CWE-787] in the DWF parsing logic within AdDwfPdk.dll. The parser fails to validate the size or offset of attacker-controlled fields in the DWF stream before writing to an internal buffer. Malformed structures inside the file cause the parser to compute an incorrect destination pointer or length, corrupting memory outside the intended allocation.

Attack Vector

Exploitation requires local delivery of a crafted DWF file and user interaction to open it in a vulnerable Autodesk product. Common vectors include phishing emails that carry the file as an attachment, shared engineering repositories, or social engineering that convinces a designer to open a project asset. No elevated privileges are required, but the attacker inherits only the user's rights on the workstation. Autodesk has not reported active exploitation, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No public proof-of-concept code is available. See the Autodesk Security Advisory ADSK-SA-2024-0014 for vendor technical details.

Detection Methods for CVE-2024-7305

Indicators of Compromise

Unexpected crashes of acad.exe or related Autodesk processes with faulting module AdDwfPdk.dll recorded in Windows Application event logs.
DWF files arriving from untrusted email senders, external file shares, or web downloads to engineering workstations.
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by AutoCAD immediately after a DWF file is opened.

Detection Strategies

Hunt for Windows Error Reporting entries where the faulting application is an Autodesk binary and the faulting module is AdDwfPdk.dll.
Alert on any process creation where the parent is an Autodesk executable and the child is a shell, script interpreter, or LOLBin.
Correlate file-write telemetry for .dwf files with subsequent AutoCAD process anomalies to identify weaponized documents.

Monitoring Recommendations

Ingest endpoint process, file, and crash telemetry from CAD workstations into a centralized data lake for retrospective hunting.
Track Autodesk product versions across the fleet and flag hosts still running builds listed as vulnerable in advisory ADSK-SA-2024-0014.
Monitor egress network connections initiated by Autodesk processes, which should not normally reach the internet outside license servers.

How to Mitigate CVE-2024-7305

Immediate Actions Required

Apply the fixed builds listed in Autodesk advisory ADSK-SA-2024-0014 to all affected AutoCAD, DWG TrueView, Civil 3D, and Advance Steel installations.
Instruct users not to open DWF files received from untrusted sources or unexpected senders until patches are deployed.
Inventory workstations for vulnerable Autodesk versions and prioritize patching of internet-exposed or high-value engineering endpoints.

Patch Information

Autodesk released fixed versions for all affected products. Consult the Autodesk Security Advisory ADSK-SA-2024-0014 for the exact fixed build numbers per product. Update through the Autodesk Access client or your enterprise deployment tooling to replace the vulnerable AdDwfPdk.dll component.

Workarounds

Block inbound .dwf attachments at the email gateway for users who do not require them, and quarantine files from external senders.
Restrict AutoCAD process outbound network access and child-process creation using application control or EDR policy.
Run AutoCAD under a standard user account with no local administrator rights to limit the impact of successful exploitation.

bash

# Example PowerShell check for the vulnerable library version on Windows workstations
Get-ChildItem -Path 'C:\Program Files\Autodesk' -Recurse -Filter 'AdDwfPdk.dll' -ErrorAction SilentlyContinue |
  ForEach-Object { [PSCustomObject]@{ Path = $_.FullName; Version = (Get-Item $_.FullName).VersionInfo.FileVersion } }