External risk intelligence

Autodesk AutoCAD Heap-Based Buffer Overflow Vulnerability in MODEL File Parsing

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-29073

The vulnerability involves parsing a malicious MODEL file within Autodesk AutoCAD, a desktop-based CAD application. As a client-side design tool, it is not an internet-facing service or infrastructure component. Exposure typically requires a user to manually open a crafted file, keeping the attack surface local and user-dependent rather than reachable via public network services.

Out-of-bounds Write

Autodesk Autocad

before 2024.12023.0.0 to before 2023.1.42024.0.0 to before 2024.1.1before 2023.1.4

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects Autodesk AutoCAD software, allowing a malicious actor to potentially crash the application, access sensitive data, or execute arbitrary code through a crafted file. The main concern is confirming relevance and exposure within our environment given the nature of the software.

Malicious files can crash AutoCAD or steal data.
Critical flaw impacts core design and drafting functions.
Confirm affected AutoCAD installations and review usage.

Attack Path

How an attacker could exploit the issue

An attacker could craft a malicious MODEL file and trick a user into opening it within an affected version of Autodesk AutoCAD. This action would trigger a vulnerability in how the application parses the file, potentially allowing the attacker to take control of the user's system.

Malicious file opened by user.
Application parses crafted file.
Arbitrary code execution possible.

Live Threat

Current exploitation, exposure, and threat context

When processed by Autodesk AutoCAD, a specially crafted MODEL file could trigger a heap-based buffer overflow. This vulnerability could allow an attacker to crash the application, potentially access sensitive data, or execute arbitrary code within the application's process under specific conditions.

Application data and user process memory.
Opening a malicious MODEL file.
Application crash or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability in Autodesk AutoCAD requires local user interaction to exploit, meaning it's primarily a concern for end-user device security. Teams responsible for managing workstations and user applications, such as desktop support or end-user computing, should lead the effort. The first practical step is to identify which users have the affected versions installed, confirm if they handle external or untrusted MODEL files, and then prioritize those with the highest risk of exposure to malicious inputs.

Application owners should manage the issue.
Verify user exposure to external MODEL files.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Autodesk AutoCAD and its role?

Autodesk AutoCAD is a widely used professional software suite for computer-aided design (CAD) and drafting. It is utilized by engineers, architects, and designers to create precise 2D and 3D technical drawings and models. The vulnerability affects the core parsing components used across various specialized AutoCAD products, including Civil 3D, Mechanical, and Electrical, which all rely on this engine to process project-related data files.

What does this heap-based buffer overflow mean?

This vulnerability is classified as a heap-based buffer overflow (CWE-122, CWE-787). In plain terms, it occurs when the software tries to store more data in a specific area of memory (the heap) than it is designed to hold. Because the software fails to properly check the size of the incoming data from a specially crafted MODEL file, the excess data can overwrite adjacent memory, potentially leading to unauthorized data access or the execution of malicious code.

How is this vulnerability triggered?

The flaw is triggered when an affected version of AutoCAD parses a malicious MODEL file. It does not trigger automatically through network activity; it requires a user to open or process the specific crafted file within the application. Simply having the software installed or connected to a network does not activate the bug, as it relies on the internal file-processing logic to encounter the problematic input.

Is my organization at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is very unlikely via traditional network-based attacks. Because AutoCAD is a desktop-based application, it is not an internet-facing service. The risk is limited to the local workstation environment, meaning the primary danger arises only if a user is tricked into opening an untrusted or malicious file from an outside source.

What are the first steps to take?

Your priority should be identifying which workstations are running the affected AutoCAD versions. Once identified, consult the official security advisory to confirm the specific patch levels required to resolve the issue. Coordinate with your desktop or endpoint management teams to apply these updates, especially for users who frequently handle design files received from external or untrusted parties.

References

www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.