What’s Vulnerable › Vulnerabilities

CVE-2024-23136: Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-22 · updated 2026-06-17
• Weakness: CWE-822

Description

A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

Affected products

• Autodesk Advance Steel: from 2021 before 2021.1.4; from 2022 before 2022.1.4; from 2023 before 2023.1.5; from 2024 before 2024.1.3; from 2025 before 2025.0.1 — fixed in 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
• Autodesk AutoCAD: from 2021 before 2021.1.4; from 2022 before 2022.1.4; from 2023 before 2023.1.5; from 2024 before 2024.1.3; from 2025 before 2025.0.1 — fixed in 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
• Autodesk AutoCAD Architecture: from 2021 before 2021.1.4; from 2022 before 2022.1.4; from 2023 before 2023.1.5; from 2024 before 2024.1.3; from 2025 before 2025.0.1 — fixed in 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
• Autodesk AutoCAD Electrical: from 2021 before 2021.1.4; from 2022 before 2022.1.4; from 2023 before 2023.1.5; from 2024 before 2024.1.3; from 2025 before 2025.0.1 — fixed in 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
• Autodesk AutoCAD MAP 3D: from 2021 before 2021.1.4; from 2022 before 2022.1.4; from 2023 before 2023.1.5; from 2024 before 2024.1.3; from 2025 before 2025.0.1 — fixed in 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
• Autodesk AutoCAD Mechanical: from 2021 before 2021.1.4; from 2022 before 2022.1.4; from 2023 before 2023.1.5; from 2024 before 2024.1.3; from 2025 before 2025.0.1 — fixed in 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
• Autodesk AutoCAD MEP: from 2021 before 2021.1.4; from 2022 before 2022.1.4; from 2023 before 2023.1.5; from 2024 before 2024.1.3; from 2025 before 2025.0.1 — fixed in 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
• Autodesk AutoCAD Plant 3D: from 2021 before 2021.1.4; from 2022 before 2022.1.4; from 2023 before 2023.1.5; from 2024 before 2024.1.3; from 2025 before 2025.0.1 — fixed in 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1
• Autodesk Civil 3D: from 2021 before 2021.1.4; from 2022 before 2022.1.4; from 2023 before 2023.1.5; from 2024 before 2024.1.3; from 2025 before 2025.0.1 — fixed in 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3, 2025.0.1

How to fix

Upgrade to a fixed version: Autodesk Advance Steel 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3; Autodesk AutoCAD 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3; Autodesk AutoCAD Architecture 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3; Autodesk AutoCAD Electrical 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3; Autodesk AutoCAD MAP 3D 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3; Autodesk AutoCAD Mechanical 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3; Autodesk AutoCAD MEP 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3; Autodesk AutoCAD Plant 3D 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3; Autodesk Civil 3D 2021.1.4, 2022.1.4, 2023.1.5, 2024.1.3. Check the vendor advisory for mitigations.

References

• https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002
• https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004
• https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002
• https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004

Get alerted when CVE-2024-23136 or the next vulnerability affects your stack