What’s Vulnerable › Vulnerabilities

CVE-2024-37002: Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-25 · updated 2026-06-17
• Weakness: CWE-457

Description

A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

Affected products

• Autodesk Advance Steel: from 2022 before 2022.1.5; from 2023 before 2023.1.6; from 2024 before 2024.1.4; from 2025 before 2025.1 — fixed in 2022.1.5, 2023.1.6, 2024.1.4, 2025.1
• Autodesk AutoCAD: from 2022 before 2022.1.5; from 2023 before 2023.1.6; from 2024 before 2024.1.4; from 2025 before 2025.1 — fixed in 2022.1.5, 2023.1.6, 2024.1.4, 2025.1
• Autodesk AutoCAD Architecture: from 2022 before 2022.1.5; from 2023 before 2023.1.6; from 2024 before 2024.1.4; from 2025 before 2025.1 — fixed in 2022.1.5, 2023.1.6, 2024.1.4, 2025.1
• Autodesk AutoCAD Electrical: from 2022 before 2022.1.5; from 2023 before 2023.1.6; from 2024 before 2024.1.4; from 2025 before 2025.1 — fixed in 2022.1.5, 2023.1.6, 2024.1.4, 2025.1
• Autodesk AutoCAD MAP 3D: from 2022 before 2022.1.5; from 2023 before 2023.1.6; from 2024 before 2024.1.4; from 2025 before 2025.1 — fixed in 2022.1.5, 2023.1.6, 2024.1.4, 2025.1
• Autodesk AutoCAD Mechanical: from 2022 before 2022.1.5; from 2023 before 2023.1.6; from 2024 before 2024.1.4; from 2025 before 2025.1 — fixed in 2022.1.5, 2023.1.6, 2024.1.4, 2025.1
• Autodesk AutoCAD MEP: from 2022 before 2022.1.5; from 2023 before 2023.1.6; from 2024 before 2024.1.4; from 2025 before 2025.1 — fixed in 2022.1.5, 2023.1.6, 2024.1.4, 2025.1
• Autodesk AutoCAD Plant 3D: from 2022 before 2022.1.5; from 2023 before 2023.1.6; from 2024 before 2024.1.4; from 2025 before 2025.1 — fixed in 2022.1.5, 2023.1.6, 2024.1.4, 2025.1
• Autodesk Civil 3D: from 2022 before 2022.1.5; from 2023 before 2023.1.6; from 2024 before 2024.1.4; from 2025 before 2025.1 — fixed in 2022.1.5, 2023.1.6, 2024.1.4, 2025.1

How to fix

Upgrade to a fixed version: Autodesk Advance Steel 2022.1.5, 2023.1.6, 2024.1.4, 2025.1; Autodesk AutoCAD 2022.1.5, 2023.1.6, 2024.1.4, 2025.1; Autodesk AutoCAD Architecture 2022.1.5, 2023.1.6, 2024.1.4, 2025.1; Autodesk AutoCAD Electrical 2022.1.5, 2023.1.6, 2024.1.4, 2025.1; Autodesk AutoCAD MAP 3D 2022.1.5, 2023.1.6, 2024.1.4, 2025.1; Autodesk AutoCAD Mechanical 2022.1.5, 2023.1.6, 2024.1.4, 2025.1; Autodesk AutoCAD MEP 2022.1.5, 2023.1.6, 2024.1.4, 2025.1; Autodesk AutoCAD Plant 3D 2022.1.5, 2023.1.6, 2024.1.4, 2025.1; Autodesk Civil 3D 2022.1.5, 2023.1.6, 2024.1.4, 2025.1. Check the vendor advisory for mitigations.

References

• https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
• https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009

Get alerted when CVE-2024-37002 or the next vulnerability affects your stack