What’s Vulnerable › Vulnerabilities

CVE-2021-40161

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-23 · updated 2026-06-17
• Weakness: CWE-787

Description

A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through PDFTron earlier than 9.0.7 version.

Affected products

• Autodesk Advance Steel: before 2019.1.4; from 2020 before 2020.1.5; from 2021 before 2021.1.2; from 2022 before 2022.1.2 — fixed in 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2
• Autodesk AutoCAD: before 2019.1.4; from 2020 before 2020.1.5; from 2021 before 2021.1.2; from 2022 before 2022.1.2; from 2022 (excl.) before 2022.2; 2020, 2021, 2022 — fixed in 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2022.2
• Autodesk AutoCAD Architecture: before 2019.1.4; from 2020 before 2020.1.5; from 2021 before 2021.1.2; from 2022 before 2022.1.2 — fixed in 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2
• Autodesk AutoCAD Electrical: before 2019.1.4; from 2020 before 2020.1.5; from 2021 before 2021.1.2; from 2022 before 2022.1.2 — fixed in 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2
• Autodesk AutoCAD LT: before 2019.1.4; from 2020 before 2020.1.5; from 2021 before 2021.1.2; from 2022 before 2022.1.2; from 2022 before 2022.2; 2020, 2021 — fixed in 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2022.2
• Autodesk AutoCAD MAP 3D: before 2019.1.4; from 2020 before 2020.1.5; from 2021 before 2021.1.2; from 2022 before 2022.1.2 — fixed in 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2
• Autodesk AutoCAD Mechanical: before 2019.1.4; from 2020 before 2020.1.5; from 2021 before 2021.1.2; from 2022 before 2022.1.2 — fixed in 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2
• Autodesk AutoCAD MEP: before 2019.1.4; from 2020 before 2020.1.5; from 2021 before 2021.1.2; from 2022 before 2022.1.2 — fixed in 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2
• Autodesk AutoCAD Plant 3D: before 2019.1.4; from 2020 before 2020.1.5; from 2021 before 2021.1.2; from 2022 before 2022.1.2 — fixed in 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2
• Autodesk Civil 3D: before 2019.1.4; from 2020 before 2020.1.5; from 2021 before 2021.1.2; from 2022 before 2022.1.2 — fixed in 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2
• Autodesk Design Review: 2018, 2018-hotfix, 2018-hotfix2, 2018-hotfix3, 2018-hotfix4
• Autodesk Navisworks: before 2019.6; from 2020 before 2020.4; from 2021 before 2021.3; from 2022 before 2022.2 — fixed in 2019.6, 2020.4, 2021.3, 2022.2
• Autodesk Revit: before 2020.2.5; from 2021 before 2021.1.6; from 2022 before 2022.1.2 — fixed in 2020.2.5, 2021.1.6, 2022.1.2

How to fix

Upgrade to a fixed version: Autodesk Advance Steel 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2; Autodesk AutoCAD 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2; Autodesk AutoCAD Architecture 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2; Autodesk AutoCAD Electrical 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2; Autodesk AutoCAD LT 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2; Autodesk AutoCAD MAP 3D 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2; Autodesk AutoCAD Mechanical 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2; Autodesk AutoCAD MEP 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2; Autodesk AutoCAD Plant 3D 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2; Autodesk Civil 3D 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2; Autodesk Navisworks 2019.6, 2020.4, 2021.3, 2022.2; Autodesk Revit 2020.2.5, 2021.1.6, 2022.1.2. Check the vendor advisory for mitigations.

References

• https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0010
• https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0010

Get alerted when CVE-2021-40161 or the next vulnerability affects your stack