DWG File Parsing Out-of-Bounds Write Vulnerability

Summary

A maliciously crafted DWG file, when parsed through certain Autodesk applications, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

Timeline

1. Apr 15, 2025, 8:55 PM UTCCVE published
2. Apr 18, 2025, 3:55 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Feb 26, 2026, 6:28 PM UTCRecord last updated

Affected versions

• Autodesk AutoCAD

  From 2025 · fixed in 2025.1.2; From 2024 · fixed in 2024.1.7; From 2023 · fixed in 2023.1.7

• Autodesk AutoCAD Architecture

  From 2025 · fixed in 2025.1.2; From 2024 · fixed in 2024.1.7; From 2023 · fixed in 2023.1.7

• Autodesk AutoCAD Electrical

  From 2025 · fixed in 2025.1.2; From 2024 · fixed in 2024.1.7; From 2023 · fixed in 2023.1.7

• Autodesk AutoCAD MAP 3D

  From 2025 · fixed in 2025.1.2; From 2024 · fixed in 2024.1.7; From 2023 · fixed in 2023.1.7

• Autodesk AutoCAD Mechanical

  From 2025 · fixed in 2025.1.2; From 2024 · fixed in 2024.1.7; From 2023 · fixed in 2023.1.7

• Autodesk AutoCAD MEP

  From 2025 · fixed in 2025.1.2; From 2024 · fixed in 2024.1.7; From 2023 · fixed in 2023.1.7

• Autodesk AutoCAD Plant 3D

  From 2025 · fixed in 2025.1.2; From 2024 · fixed in 2024.1.7; From 2023 · fixed in 2023.1.7

• Autodesk Advance Steel

  From 2025 · fixed in 2025.1.2; From 2024 · fixed in 2024.1.7; From 2023 · fixed in 2023.1.7

• Autodesk AutoCAD LT

  From 2025 · fixed in 2025.1.2; From 2024 · fixed in 2024.1.7; From 2023 · fixed in 2023.1.7

• Autodesk RealDWG

  From 2025 · fixed in 2025.1.2; From 2024 · fixed in 2024.1.7

• Autodesk DWG TrueView

  From 2025 · fixed in 2025.1.2; From 2024 · fixed in 2024.1.7; From 2023 · fixed in 2023.1.7

References 3