CVE-2023-25004

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-27 · updated 2026-06-17
Weakness: CWE-190

Description

A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Exploitation of these vulnerabilities may lead to code execution.

Affected products

Autodesk Alias: from 2023 before 2023.1.1 — fixed in 2023.1.1
Autodesk AutoCAD: from 2020 before 2020.1.6; from 2021 before 2021.1.3; from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk Autocad Advance Steel: from 2020 before 2020.1.6; from 2021 before 2021.1.3; from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk AutoCAD Architecture: from 2020 before 2020.1.6; from 2021 before 2021.1.3; from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk Autocad Civil 3D: from 2020 before 2020.1.6; from 2021 before 2021.1.3; from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk AutoCAD Electrical: from 2020 before 2020.1.6; from 2021 before 2021.1.3; from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk AutoCAD LT: from 2020 before 2020.1.6; from 2021 before 2021.1.3; from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk AutoCAD MAP 3D: from 2020 before 2020.1.6; from 2021 before 2021.1.3; from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk AutoCAD Mechanical: from 2020 before 2020.1.6; from 2021 before 2021.1.3; from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk AutoCAD MEP: from 2020 before 2020.1.6; from 2021 before 2021.1.3; from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk AutoCAD Plant 3D: from 2020 before 2020.1.6; from 2021 before 2021.1.3; from 2022 before 2022.1.3; from 2023 before 2023.1.1 — fixed in 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk InfraWorks: from 2021 before 2021.2; from 2022 before 2022.1; from 2023 before 2023.1 — fixed in 2021.2, 2022.1, 2023.1
Autodesk Inventor: from 2021 before 2021.5; from 2022 before 2022.4; from 2023 before 2023.3.1 — fixed in 2021.5, 2022.4, 2023.3.1
Autodesk Maya USD Plugin: from 2022 before 2022.5; from 2023 before 2023.3 — fixed in 2022.5, 2023.3
Autodesk Navisworks: from 2022 before 2022.4; from 2023 before 2023.2 — fixed in 2022.4, 2023.2
Autodesk Revit: from 2021 before 2021.1.8 — fixed in 2021.1.8
Autodesk VRED Design: from 2023 before 2023.4 — fixed in 2023.4

How to fix

Upgrade to a fixed version: Autodesk Alias 2023.1.1; Autodesk AutoCAD 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1; Autodesk Autocad Advance Steel 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1; Autodesk AutoCAD Architecture 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1; Autodesk Autocad Civil 3D 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1; Autodesk AutoCAD Electrical 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1; Autodesk AutoCAD LT 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1; Autodesk AutoCAD MAP 3D 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1; Autodesk AutoCAD Mechanical 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1; Autodesk AutoCAD MEP 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1; Autodesk AutoCAD Plant 3D 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1; Autodesk InfraWorks 2021.2, 2022.1, 2023.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-25004 or the next vulnerability affects your stack