High severity · published Jun 25, 2024
CVE-2024-37002
A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Advance Steel · Autodesk
2022 before 2022.1.5; 2023 before 2023.1.6; 2024 before 2024.1.4; 2025 before 2025.1 · source: NVD
AU
Autocad · Autodesk
2022 before 2022.1.5; 2023 before 2023.1.6; 2024 before 2024.1.4; 2025 before 2025.1 · source: NVD
AA
Autocad Architecture · Autodesk
2022 before 2022.1.5; 2023 before 2023.1.6; 2024 before 2024.1.4; 2025 before 2025.1 · source: NVD
AE
Autocad Electrical · Autodesk
2022 before 2022.1.5; 2023 before 2023.1.6; 2024 before 2024.1.4; 2025 before 2025.1 · source: NVD
AM
Autocad Map 3d · Autodesk
2022 before 2022.1.5; 2023 before 2023.1.6; 2024 before 2024.1.4; 2025 before 2025.1 · source: NVD
AM
Autocad Mechanical · Autodesk
2022 before 2022.1.5; 2023 before 2023.1.6; 2024 before 2024.1.4; 2025 before 2025.1 · source: NVD
AM
Autocad Mep · Autodesk
2022 before 2022.1.5; 2023 before 2023.1.6; 2024 before 2024.1.4; 2025 before 2025.1 · source: NVD
AP
Autocad Plant 3d · Autodesk
2022 before 2022.1.5; 2023 before 2023.1.6; 2024 before 2024.1.4; 2025 before 2025.1 · source: NVD
C3
Civil 3d · Autodesk
2022 before 2022.1.5; 2023 before 2023.1.6; 2024 before 2024.1.4; 2025 before 2025.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-37002
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-37002
Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
More from Advance Steel
7.8
CVE-2026-7406
BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products
7.8
CVE-2026-16463
DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD
7.8
CVE-2025-8894
A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability
7.8
CVE-2025-8893
A maliciously crafted PDF file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability
7.8
CVE-2025-5048
A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force a Memory Corruption vulnerability