CVE-2024-9997: Autodesk AutoCAD RCE Vulnerability

CVE-2024-9997 Overview

CVE-2024-9997 is a memory corruption vulnerability affecting Autodesk AutoCAD and related products. The flaw resides in acdb25.dll and triggers when the application parses a maliciously crafted DWG file. An attacker who convinces a user to open a specially crafted DWG file can crash the application, disclose sensitive memory contents, or execute arbitrary code in the context of the current process.

The vulnerability is tracked under CWE-120 (Buffer Copy without Checking Size of Input) and CWE-787 (Out-of-bounds Write). Exploitation requires local file access and user interaction.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the AutoCAD process, potentially compromising sensitive design data and the underlying workstation.

Affected Products

Autodesk AutoCAD and AutoCAD LT
Autodesk AutoCAD Advance Steel, Architecture, Civil 3D, Electrical, Mechanical, MEP, and Plant 3D
Autodesk DWG TrueView

Discovery Timeline

2024-10-29 - CVE-2024-9997 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9997

Vulnerability Analysis

The vulnerability lives in acdb25.dll, the AutoCAD database library responsible for parsing DWG drawing files. When the library processes a malformed DWG structure, it performs an out-of-bounds write, corrupting adjacent memory. This corruption can overwrite heap metadata, function pointers, or control-flow structures used later in execution.

Because the DWG format is complex and hierarchical, individual object records carry length or offset fields that influence buffer sizing during parsing. Insufficient validation of these fields allows attacker-controlled data to overflow a fixed-size destination buffer.

Root Cause

The root cause is missing or incorrect bounds checking during deserialization of DWG object data in acdb25.dll. The parser trusts length or count fields embedded in the file rather than validating them against the actual destination buffer size. This condition maps to CWE-120 and results in the CWE-787 out-of-bounds write.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers the crafted DWG through email, a shared network location, a supply-chain project file, or a malicious download. When the victim opens the file in AutoCAD or DWG TrueView, acdb25.dll parses the payload and triggers the memory corruption.

Because code execution occurs in the context of the current process, the attacker inherits the user's privileges on the workstation. Engineering, architecture, and manufacturing environments frequently share DWG files across organizational boundaries, expanding the practical attack surface.

No public proof-of-concept exploit is currently associated with this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-9997

Indicators of Compromise

Unexpected crashes of acad.exe, dwgviewr.exe, or related Autodesk processes with faulting module acdb25.dll.
Windows Error Reporting (WER) entries or minidumps referencing access violations inside acdb25.dll during DWG file open operations.
DWG files arriving from untrusted sources with anomalous size, malformed headers, or inconsistent object records.

Detection Strategies

Monitor endpoint telemetry for AutoCAD processes spawning unexpected child processes such as cmd.exe, powershell.exe, or script interpreters.
Correlate DWG file open events with subsequent process crashes, memory allocation anomalies, or shellcode-like behavior.
Apply behavioral detection for post-exploitation patterns including credential access, LSASS interaction, or outbound C2 traffic originating from Autodesk processes.

Monitoring Recommendations

Ingest AutoCAD application logs and Windows crash telemetry into a centralized SIEM or data lake for correlation.
Track file provenance for DWG files, especially those received via email or from external contractors.
Alert on modifications to AutoCAD installation directories and on the loading of unsigned modules by Autodesk processes.

How to Mitigate CVE-2024-9997

Immediate Actions Required

Apply the vendor patches referenced in Autodesk Security Advisory ADSK-SA-2024-0021 to all affected AutoCAD, AutoCAD-based verticals, and DWG TrueView installations.
Inventory endpoints running vulnerable Autodesk products and prioritize patching for hosts that handle externally sourced DWG files.
Instruct users to avoid opening DWG files from untrusted or unverified senders until patching is complete.

Patch Information

Autodesk has issued fixed versions for the affected products. Refer to Autodesk Security Advisory ADSK-SA-2024-0021 for the specific patched builds for AutoCAD, AutoCAD LT, the vertical products (Advance Steel, Architecture, Civil 3D, Electrical, Mechanical, MEP, Plant 3D), and DWG TrueView.

Workarounds

Restrict opening of DWG files to trusted internal sources only until patches are deployed.
Run AutoCAD under standard (non-administrative) user accounts to limit the impact of successful code execution.
Enable Windows exploit mitigations such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) for Autodesk executables.
Use application allowlisting to prevent Autodesk processes from launching unauthorized child processes or scripts.

bash

# Verify installed AutoCAD version on Windows to confirm patch status
wmic product where "Name like 'Autodesk AutoCAD%%'" get Name,Version