High severity · published Jan 25, 2022
CVE-2021-40158
A maliciously crafted JT file in Autodesk Inventor 2022, 2021, 2020, 2019 and AutoCAD 2022 may be forced to read beyond allocated boundaries when parsing the JT file
7.8
CVSS
2.9%
EPSS
No
On KEV
Description
A maliciously crafted JT file in Autodesk Inventor 2022, 2021, 2020, 2019 and AutoCAD 2022 may be forced to read beyond allocated boundaries when parsing the JT file. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Inventor ·
2022, 2021, 2020, 2019 · source: vendor, NVD
AS
Advance Steel · Autodesk
2022 before 2022.1.2 · source: NVD
AU
Autocad · Autodesk
2022 before 2022.1.2 · source: NVD
AA
Autocad Architecture · Autodesk
2022 before 2022.1.2 · source: NVD
AE
Autocad Electrical · Autodesk
2022 before 2022.1.2 · source: NVD
AL
Autocad LT · Autodesk
2022 before 2022.1.2 · source: NVD
AM
Autocad Map 3d · Autodesk
2022 before 2022.1.2 · source: NVD
AM
Autocad Mechanical · Autodesk
2022 before 2022.1.2 · source: NVD
AM
Autocad Mep · Autodesk
2022 before 2022.1.2 · source: NVD
AP
Autocad Plant 3d · Autodesk
2022 before 2022.1.2 · source: NVD
C3
Civil 3d · Autodesk
2022 before 2022.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40158
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40158
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-281/
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-283/
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-284/
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-285/
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-286/
More from Inventor
7.8
CVE-2021-40159
An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022, 2021, 2020, 2019 in conjunction with other vulnerabilities may lead to code execution through…