High severity · published Oct 7, 2022
CVE-2021-40163
A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing component
7.8
CVSS
1%
EPSS
No
On KEV
Description
A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing component.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RI
AU
Autocad · Autodesk
2019 before 2019.1.4; 2020 before 2020.1.5; 2021 before 2021.1.2; 2022 before 2022.1.2 · source: NVD
AA
Autocad Advance Steel · Autodesk
2019 before 2019.1.4; 2020 before 2020.1.5; 2021 before 2021.1.2; 2022 before 2022.1.2 · source: NVD
AA
Autocad Architecture · Autodesk
2019 before 2019.1.4; 2020 before 2020.1.5; 2021 before 2021.1.2; 2022 before 2022.1.2 · source: NVD
AC
Autocad Civil 3d · Autodesk
2019 before 2019.1.4; 2020 before 2020.1.5; 2021 before 2021.1.2; 2022 before 2022.1.2 · source: NVD
AE
Autocad Electrical · Autodesk
2019 before 2019.1.4; 2020 before 2020.1.5; 2021 before 2021.1.2; 2022 before 2022.1.2 · source: NVD
AL
Autocad LT · Autodesk
2019 before 2019.1.4; 2020 before 2020.1.5; 2020 before 2020.3.2; 2021 before 2021.1.2; 2021 before 2021.2.2; 2022 before 2022.1.2; +1 more · source: NVD
AM
Autocad Map 3d · Autodesk
2019 before 2019.1.4; 2020 before 2020.1.5; 2021 before 2021.1.2; 2022 before 2022.1.2 · source: NVD
AM
Autocad Mechanical · Autodesk
2019 before 2019.1.4; 2020 before 2020.1.5; 2021 before 2021.1.2; 2022 before 2022.1.2 · source: NVD
AM
Autocad Mep · Autodesk
2019 before 2019.1.4; 2020 before 2020.1.5; 2021 before 2021.1.2; 2022 before 2022.1.2 · source: NVD
AP
Autocad Plant 3d · Autodesk
2019 before 2019.1.4; 2020 before 2020.1.5; 2021 before 2021.1.2; 2022 before 2022.1.2 · source: NVD
DR
Design Review · Autodesk
2018; 2018; 2018; 2018 · source: NVD
Affected product
RI
Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure Parts Editors, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40163
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40163
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011
More from Revit, Inventor, Infraworks, Navisworks, Fusion, Infrastructure Parts Editors, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
7.8
CVE-2021-40162
A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA, or…
7.8
CVE-2021-40164
A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files
7.8
CVE-2021-40165
A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer while parsing TIFF, PICT, TGA, or RLC…
7.8
CVE-2021-40166
A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them