Out-of-bounds write in Autodesk products - CVE-2022-33889

Vulnerability identifier: #VU67690

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-33889

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing GIF or JPEG files. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Autodesk Design Review
AutoCAD MEP
AutoCAD Architecture
AutoCAD Electrical
AutoCAD Map 3D
AutoCAD Mechanical
AutoCAD Plant 3D
AutoCAD LT
Advance Steel
Autodesk Civil 3D
Infrastructure Parts Editor
AutoCAD for Mac LT
AutoCAD Mac
Revit
DWG Trueview
Storm and Sanitary Analysis (SSA)
Autodesk AutoCAD
Autodesk Inventor

Install updates from vendor's website.

Autodesk Design Review - update to 2018 Hotfix 7
AutoCAD MEP - addressed in versions 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk AutoCAD - addressed in versions 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
AutoCAD Architecture - addressed in versions 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
AutoCAD Electrical - addressed in versions 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
AutoCAD Map 3D - addressed in versions 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
AutoCAD Mechanical - addressed in versions 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
AutoCAD Plant 3D - addressed in versions 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
AutoCAD LT - addressed in versions 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Advance Steel - addressed in versions 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Autodesk Civil 3D - addressed in versions 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Infrastructure Parts Editor - addressed in versions 2020.0.4, 2021.0.3, 2022.0.3, 2023.0.1
AutoCAD for Mac LT - addressed in versions 2021.3, 2022.3, 2023.2
AutoCAD Mac - addressed in versions 2021.3, 2022.3, 2023.2
Autodesk Inventor - addressed in versions 2022.4, 2023.2
Revit - update to 2023.1
DWG Trueview - addressed in versions 2020.1.6, 2021.1.3, 2022.1.3, 2023.1.1
Storm and Sanitary Analysis (SSA) - addressed in versions 2020.3.3, 2021.3.3, 2022.0.3, 2023.0.2

• https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0021
• https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0025

• Multiple vulnerabilities in Autodesk Design Review and AutoCAD programs
• Multiple vulnerabilities in AutoCAD for Mac
• Multiple vulnerabilities in Autodesk Revit
• Multiple vulnerabilities in Autodesk Inventor
• Multiple vulnerabilities in Autodesk Infrastructure Parts Editor
• Multiple vulnerabilities in Autodesk Storm and Sanitary Analysis
• Multiple vulnerabilities in Autodesk DWG Trueview