High severity · published Apr 19, 2022
CVE-2022-27527
A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files
7.8
CVSS
0.5%
EPSS
No
On KEV
Description
A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files. It was fixed in PDFTron earlier than 9.0.7 version in Autodesk Navisworks 2022, and 2020.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Navisworks · Autodesk
2019 before 2019.6; 2020 before 2020.4; 2021 before 2021.3; 2022 before 2022.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-27527
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-27527
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0010
More from Navisworks
7.8
CVE-2025-1660
DWFX File Parsing Memory Corruption Vulnerability
7.8
CVE-2025-1659
DWFX File Parsing Out-of-Bounds Read Vulnerability
7.8
CVE-2025-1658
DWFX File Parsing Out-of-Bounds Read Vulnerability
7.8
CVE-2024-12671
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability
7.8
CVE-2024-12670
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability