What’s Vulnerable › Vulnerabilities

CVE-2022-33886

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-03 · updated 2026-06-17
• Weakness: CWE-755

Description

A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2022, 2021, 2020, and Maya 2023 and 2022. The vulnerability exists because the application fails to handle crafted MODEL and SLDPRT files, which causes an unhandled exception. A malicious actor could leverage this vulnerability to execute arbitrary code.

Affected products

• Autodesk AutoCAD: from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2022.1.3, 2023.1.1
• Autodesk Autocad Advance Steel: from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2022.1.3, 2023.1.1
• Autodesk AutoCAD Architecture: from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2022.1.3, 2023.1.1
• Autodesk Autocad Civil 3D: from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2022.1.3, 2023.1.1
• Autodesk AutoCAD Electrical: from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2022.1.3, 2023.1.1
• Autodesk AutoCAD LT: from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2022.1.3, 2023.1.1
• Autodesk AutoCAD MAP 3D: from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2022.1.3, 2023.1.1
• Autodesk AutoCAD Mechanical: from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2022.1.3, 2023.1.1
• Autodesk AutoCAD MEP: from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2022.1.3, 2023.1.1
• Autodesk AutoCAD Plant 3D: from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2022.1.3, 2023.1.1

How to fix

Upgrade to a fixed version: Autodesk AutoCAD 2022.1.3, 2023.1.1; Autodesk Autocad Advance Steel 2022.1.3, 2023.1.1; Autodesk AutoCAD Architecture 2022.1.3, 2023.1.1; Autodesk Autocad Civil 3D 2022.1.3, 2023.1.1; Autodesk AutoCAD Electrical 2022.1.3, 2023.1.1; Autodesk AutoCAD LT 2022.1.3, 2023.1.1; Autodesk AutoCAD MAP 3D 2022.1.3, 2023.1.1; Autodesk AutoCAD Mechanical 2022.1.3, 2023.1.1; Autodesk AutoCAD MEP 2022.1.3, 2023.1.1; Autodesk AutoCAD Plant 3D 2022.1.3, 2023.1.1. Check the vendor advisory for mitigations.

References

• https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020
• https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020

Get alerted when CVE-2022-33886 or the next vulnerability affects your stack