Use-after-free in Autodesk products - CVE-2022-27528

Vulnerability identifier: #VU61926

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2022-27528

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Autodesk

Affected software:
Autodesk AutoCAD
Autodesk Navisworks
Advance Steel
AutoCAD Architecture
Autodesk Civil 3D
AutoCAD Electrical
AutoCAD Map 3D
AutoCAD Mechanical
AutoCAD MEP
AutoCAD Plant 3D
AutoCAD LT
AutoCAD Mac
AutoCAD Mac LT

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the parsing the DWFX and SKP files. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install updates from vendor's website.

• https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005
• https://www.zerodayinitiative.com/advisories/ZDI-22-557/
• https://www.zerodayinitiative.com/advisories/ZDI-22-566/
• https://www.zerodayinitiative.com/advisories/ZDI-22-568/