What’s Vulnerable › Vulnerabilities
CVE-2021-40160
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-12-23 · updated 2026-06-17
- Weakness: CWE-125
Description
PDFTron prior to 9.0.7 version may be forced to read beyond allocated boundaries when parsing a maliciously crafted PDF file. This vulnerability can be exploited to execute arbitrary code.
Affected products
- Autodesk Advance Steel: from 2022 before 2022.1.1 — fixed in 2022.1.1
- Autodesk AutoCAD: from 2022 before 2022.1.1; from 2022 before 2022.2 — fixed in 2022.1.1, 2022.2
- Autodesk AutoCAD Architecture: from 2022 before 2022.1.1 — fixed in 2022.1.1
- Autodesk AutoCAD Electrical: from 2022 before 2022.1.1 — fixed in 2022.1.1
- Autodesk AutoCAD LT: from 2022 before 2022.1.1; from 2022 before 2022.2 — fixed in 2022.1.1, 2022.2
- Autodesk AutoCAD MAP 3D: from 2022 before 2022.1.1 — fixed in 2022.1.1
- Autodesk AutoCAD Mechanical: from 2022 before 2022.1.1 — fixed in 2022.1.1
- Autodesk AutoCAD MEP: from 2022 before 2022.1.1 — fixed in 2022.1.1
- Autodesk AutoCAD Plant 3D: from 2022 before 2022.1.1 — fixed in 2022.1.1
- Autodesk Civil 3D: from 2022 before 2022.1.1 — fixed in 2022.1.1
- Autodesk Design Review: 2018, 2018-hotfix, 2018-hotfix2, 2018-hotfix3, 2018-hotfix4
- Autodesk Navisworks: from 2019 before 2019.6; from 2020 before 2020.4; from 2021 before 2021.3; from 2022 before 2022.1 — fixed in 2019.6, 2020.4, 2021.3, 2022.1
- Autodesk Revit: from 2020 before 2020.2.5; from 2021 before 2021.1.4; from 2022 before 2022.1 — fixed in 2020.2.5, 2021.1.4, 2022.1
How to fix
Upgrade to a fixed version: Autodesk Advance Steel 2022.1.1; Autodesk AutoCAD 2022.1.1, 2022.2; Autodesk AutoCAD Architecture 2022.1.1; Autodesk AutoCAD Electrical 2022.1.1; Autodesk AutoCAD LT 2022.1.1, 2022.2; Autodesk AutoCAD MAP 3D 2022.1.1; Autodesk AutoCAD Mechanical 2022.1.1; Autodesk AutoCAD MEP 2022.1.1; Autodesk AutoCAD Plant 3D 2022.1.1; Autodesk Civil 3D 2022.1.1; Autodesk Navisworks 2019.6, 2020.4, 2021.3, 2022.1; Autodesk Revit 2020.2.5, 2021.1.4, 2022.1. Check the vendor advisory for mitigations.
References
- https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0010
- https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0010
Get alerted when CVE-2021-40160 or the next vulnerability affects your stack