External risk intelligence

Autodesk AutoCAD CATPART File Parsing Out-Of-Bounds Write Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-29074

This vulnerability requires a user to open a maliciously crafted CATPART file within Autodesk AutoCAD software. It is a client-side application vulnerability rather than a service-based or network-accessible one. Such software is typically used locally on workstations and does not represent a public-facing network service, gateway, or internet-accessible API.

Out-of-bounds Write

Autodesk Autocad

before 2024.12023.0.0 to before 2023.1.42024.0.0 to before 2024.1.1before 2023.1.4

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Autodesk AutoCAD software that could allow an attacker to cause crashes, read sensitive data, or execute arbitrary code. This issue arises from the way the software processes specific file types, potentially impacting the confidentiality, integrity, and availability of operations. The main concern is confirming relevance and exposure.

Malicious files can compromise AutoCAD software.
It could lead to data exposure or code execution.
Confirm if your AutoCAD use is impacted.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into opening a specially crafted CATPART file, which is then processed by Autodesk AutoCAD. This file can trigger an out-of-bounds write, potentially allowing the attacker to crash the application, access sensitive information, or run their own code.

Requires user to open a malicious file.
Vulnerability triggered by file parsing.
Risk of code execution or data access.

Live Threat

Current exploitation, exposure, and threat context

When a specially crafted CATPART file is processed by Autodesk AutoCAD, an out-of-bounds write vulnerability could permit an attacker to crash the application, access sensitive information, or execute arbitrary code within the software's current process. This risk exists when users open malicious files.

System data and sensitive information at risk.
Opening malicious CATPART files.
Application crash or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security teams and application owners are responsible for addressing this vulnerability. The first practical step is to identify all instances of the affected Autodesk AutoCAD software, determine their reachability and business criticality, and confirm the accountable owners before planning remediation.

Identify affected AutoCAD deployments.
Verify exposure and business impact.
Coordinate vendor patching with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2023-29074?

The affected software includes various versions of Autodesk AutoCAD and related industry-specific toolsets like AutoCAD Architecture, Mechanical, Civil 3D, and Plant 3D. These professional design and engineering applications are widely used for 2D drafting and 3D modeling. The vulnerability impacts how these programs handle specific file formats during the design process.

What does an out-of-bounds write vulnerability mean in this context?

This refers to a memory safety weakness, specifically CWE-787. It occurs when the software writes data beyond the intended boundaries of a memory buffer. When processing a maliciously crafted CATPART file, AutoCAD may overwrite adjacent memory areas. This can corrupt application data, leading to a program crash, unauthorized disclosure of information, or the potential execution of attacker-supplied code.

How is this vulnerability triggered?

The vulnerability is triggered when a user opens a specially crafted CATPART file within an affected version of Autodesk AutoCAD. It is not triggered by simply having the software installed or by network traffic alone. If a user does not open a malicious file, the specific memory corruption flaw remains dormant, as it requires the software's parsing engine to actively process the problematic file structure.

Do I need to worry if I only use AutoCAD internally?

Halo Surface Signal notes this is a client-side application vulnerability rather than a network-accessible service. While the CVSS severity is high, the practical risk depends on the likelihood of a user opening an untrusted file. Because AutoCAD typically runs locally on workstations, it is not an internet-facing service, meaning your primary concern is the source of the design files your team processes.

What are the first steps to take?

Start by identifying all workstations or systems running the affected versions of AutoCAD or its toolsets listed in the advisory. Once identified, consult official Autodesk security resources to confirm the specific patch or update version required for your environment. Coordination with the system owners is essential to plan the installation of these updates, ensuring your design software is secure against this file-parsing flaw.

References

www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.