High severity · published Jul 9, 2021
CVE-2021-27039
A maliciously crafted TIFF and PCX file can be forced to read and write beyond allocated boundaries when parsing the TIFF and PCX file for based overflow
7.8
CVSS
1.6%
EPSS
No
On KEV
Description
A maliciously crafted TIFF and PCX file can be forced to read and write beyond allocated boundaries when parsing the TIFF and PCX file for based overflow. This vulnerability can be exploited to execute arbitrary code.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
Autocad · Autodesk
before 2022.1.1 · source: NVD
DR
Design Review · Autodesk
2011; 2012; 2013; 2017; 2018 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27039
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27039
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
More from Autocad
9.8
CVE-2023-29076
A maliciously crafted MODEL, SLDASM, SAT or CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 could cause memory corruption vulnerability
9.8
CVE-2023-29075
A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write
9.8
CVE-2023-29074
A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write
9.8
CVE-2023-29073
A maliciously crafted MODEL file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow
7.8
CVE-2026-7406
BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products