CVE-2021-40158 – This vulnerability allows a malicious JT file t... (How to Fix)

Q: What is the severity of CVE-2021-40158?

CVE-2021-40158 has a CVSS score of 7.8 (HIGH). This vulnerability allows a malicious JT file to cause Autodesk Inventor and AutoCAD to read beyond allocated memory boundaries. When combined with other vulnerabilities, this could lead to arbitrary code execution in the context of the current process. Users of affected Autodesk products are at risk.

📋 TL;DR

This vulnerability allows a malicious JT file to cause Autodesk Inventor and AutoCAD to read beyond allocated memory boundaries. When combined with other vulnerabilities, this could lead to arbitrary code execution in the context of the current process. Users of affected Autodesk products are at risk.

💻 Affected Systems

Products:

Autodesk Inventor
Autodesk AutoCAD

Versions: Inventor 2019, 2020, 2021, 2022; AutoCAD 2022

Operating Systems: Windows

Default Config Vulnerable: ⚠️ Yes

Notes: All default installations are vulnerable. Requires opening malicious JT files.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Arbitrary code execution leading to full system compromise, data theft, or ransomware deployment when combined with other vulnerabilities.

🟠

Likely Case

Application crash (denial of service) or limited information disclosure from memory reads.

🟢

If Mitigated

Application crash with no data loss if proper sandboxing and memory protections are in place.

🌐 Internet-Facing: LOW - Requires user interaction to open malicious files, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Internal users could be tricked into opening malicious files via email or shared drives.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Requires user interaction to open malicious file. Needs to be combined with other vulnerabilities for code execution.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Updates available through Autodesk Desktop App or Autodesk Account

Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002

Restart Required: Yes

Instructions:

1. Open Autodesk Desktop App or log into Autodesk Account. 2. Check for available updates. 3. Install all security updates for affected products. 4. Restart computer after installation.

🔧 Temporary Workarounds

Block JT file extensions

windows

Prevent opening of JT files via group policy or application whitelisting

Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > Software Restriction Policies > Additional Rules > New Path Rule: Path: *.jt, Security Level: Disallowed

User awareness training

all

Train users not to open JT files from untrusted sources

🧯 If You Can't Patch

Implement application whitelisting to prevent execution of unauthorized files
Use email filtering to block JT attachments and implement web filtering for malicious downloads

🔍 How to Verify

Check if Vulnerable:

Check installed version of Autodesk Inventor or AutoCAD against affected versions list

Check Version:

For Inventor: Help > About Inventor; For AutoCAD: Help > About AutoCAD

Verify Fix Applied:

Verify version is updated beyond vulnerable versions and check Autodesk Desktop App for no pending updates

📡 Detection & Monitoring

Log Indicators:

Application crash logs from Autodesk products
Windows Event Logs: Application Error events for Inventor/AutoCAD

Network Indicators:

Unusual outbound connections after opening JT files
JT file downloads from untrusted sources

SIEM Query:

EventID=1000 AND SourceName="Application Error" AND (ProcessName="Inventor.exe" OR ProcessName="acad.exe")

📊 Metadata

CVE ID: CVE-2021-40158

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-125

Published: January 25, 2022

Last Updated: November 21, 2024

🔗 References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-281/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-283/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-284/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-285/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-286/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-287/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-288/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-441/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-443/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-444/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-445/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-447/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-448/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-449/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-450/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-451/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-452/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-453/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-454/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-455/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-466/ Third Party Advisory,VDB Entry
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-281/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-283/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-284/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-285/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-286/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-287/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-288/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-441/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-443/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-444/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-445/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-447/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-448/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-449/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-450/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-451/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-452/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-453/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-454/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-455/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-466/ Third Party Advisory,VDB Entry

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-40158, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Advance Steel by Autodesk

Autocad by Autodesk

Autocad Architecture by Autodesk

Autocad Electrical by Autodesk

Autocad Lt by Autodesk

Autocad Map 3d by Autodesk

Autocad Mechanical by Autodesk

Autocad Mep by Autodesk

Autocad Plant 3d by Autodesk

Civil 3d by Autodesk

Inventor by Autodesk

Inventor by Autodesk

Inventor by Autodesk

Inventor by Autodesk

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Block JT file extensions

User awareness training

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities