CVE-2023-29074
criticalA maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write.
Vendor / product: Autodesk — autocad
A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2023-11-23 04:15
Modified: 2026-11-02 23:17
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-11-03 07:33 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
autodesk / autocad <2024.1, ≥2023.0.0 <2023.1.4, ≥2024.0.0 <2024.1.1
autodesk / autocad_advance_steel <2023.1.4, ≥2024.0.0 <2024.1.1
autodesk / autocad_architecture <2023.1.4, ≥2024.0.0 <2024.1.1
autodesk / autocad_civil_3d <2023.1.4, ≥2024.0.0 <2024.1.1
autodesk / autocad_electrical <2023.1.4, ≥2024.0.0 <2024.1.1
autodesk / autocad_lt <2023.1.4, <2024.1, ≥2024.0.0 <2024.1.1
autodesk / autocad_map_3d <2023.1.4, ≥2024.0.0 <2024.1.1
autodesk / autocad_mechanical <2023.1.4, ≥2024.0.0 <2024.1.1
autodesk / autocad_mep <2023.1.4, ≥2024.0.0 <2024.1.1
autodesk / autocad_plant_3d <2023.1.4, ≥2024.0.0 <2024.1.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018
Vendor advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018
References
- https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018 psirt@autodesk.com
- https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018 af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-11-03 07:33 UTC · record ↗