Heap-based buffer overflow in Autodesk products - CVE-2022-27871
Published: June 1, 2022
Vulnerability identifier: #VU63919
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-27871
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can pass specially crafted PDF file, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Autodesk Design Review
Revit
AutoCAD Mechanical
AutoCAD Architecture
Autodesk Civil 3D
AutoCAD Plant 3D
AutoCAD Electrical
AutoCAD MEP
AutoCAD LT
Advance Steel
AutoCAD Map 3D
AutoCAD for Mac LT
AutoCAD Mac
Autodesk AutoCAD
Autodesk 3ds Max
Autodesk Navisworks
Revit
AutoCAD Mechanical
AutoCAD Architecture
Autodesk Civil 3D
AutoCAD Plant 3D
AutoCAD Electrical
AutoCAD MEP
AutoCAD LT
Advance Steel
AutoCAD Map 3D
AutoCAD for Mac LT
AutoCAD Mac
Autodesk AutoCAD
Autodesk 3ds Max
Autodesk Navisworks
How to mitigate CVE-2022-27871
Install updates from vendor's website.
Autodesk Design Review - update to 2018 Hotfix 6
Revit - addressed in versions 2020.2.8, 2021.1.6, 2022.1.2
AutoCAD Mechanical - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD Architecture - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
Autodesk Civil 3D - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD Plant 3D - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD Electrical - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
Autodesk AutoCAD - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD MEP - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD LT - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
Advance Steel - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD Map 3D - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
Autodesk Navisworks - addressed in versions 2019.7, 2020.5, 2022.2
Autodesk 3ds Max - addressed in versions 2021.3.8, 2022.3.3
AutoCAD for Mac LT - update to 2022.2.2
AutoCAD Mac - update to 2022.2.2
Revit - addressed in versions 2020.2.8, 2021.1.6, 2022.1.2
AutoCAD Mechanical - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD Architecture - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
Autodesk Civil 3D - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD Plant 3D - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD Electrical - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
Autodesk AutoCAD - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD MEP - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD LT - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
Advance Steel - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
AutoCAD Map 3D - addressed in versions 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2, 2023.0.1
Autodesk Navisworks - addressed in versions 2019.7, 2020.5, 2022.2
Autodesk 3ds Max - addressed in versions 2021.3.8, 2022.3.3
AutoCAD for Mac LT - update to 2022.2.2
AutoCAD Mac - update to 2022.2.2