CVE-2023-25003
📋 TL;DR
This vulnerability in Autodesk AutoCAD 2023 and Maya 2022 allows attackers to execute arbitrary code by exploiting out-of-bounds read/write vulnerabilities in the pskernel.dll file. Users of these specific Autodesk products are affected when opening maliciously crafted files.
💻 Affected Systems
- Autodesk AutoCAD
- Autodesk Maya
📦 What is this software?
Alias by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Lt by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Infraworks by Autodesk
Inventor by Autodesk
Inventor by Autodesk
Inventor by Autodesk
Maya Usd by Autodesk
Maya Usd by Autodesk
Navisworks by Autodesk
Navisworks by Autodesk
Revit by Autodesk
Vred by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user running the vulnerable software, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local code execution when a user opens a malicious file, potentially leading to malware installation or credential theft.
If Mitigated
Limited impact if software runs with minimal privileges, network segmentation is in place, and users are trained to avoid untrusted files.
🎯 Exploit Status
Exploitation requires user interaction to open malicious files. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk Security Advisory ADSK-SA-2023-0009 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009
Restart Required: Yes
Instructions:
1. Open affected Autodesk product. 2. Navigate to Help > About. 3. Check for updates or use Autodesk Desktop App. 4. Apply available security updates. 5. Restart the application.
🔧 Temporary Workarounds
Restrict file execution
windowsBlock execution of untrusted AutoCAD/Maya files via application control policies
User training
allTrain users to only open trusted files from verified sources
🧯 If You Can't Patch
- Run AutoCAD/Maya with minimal user privileges (not as administrator)
- Implement application whitelisting to prevent execution of untrusted files
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD/Maya version against affected versions (AutoCAD 2023, Maya 2022). If using these versions and not patched, system is vulnerable.Check Version:
In AutoCAD/Maya: Help > About or check program propertiesVerify Fix Applied:
Verify version has been updated beyond vulnerable versions listed in Autodesk advisory ADSK-SA-2023-0009📡 Detection & Monitoring
Log Indicators:
- Application crashes in AutoCAD/Maya with memory access violations
- Unexpected process creation from AutoCAD/Maya executables
Network Indicators:
- Unusual outbound connections from AutoCAD/Maya processes
SIEM Query:
Process creation where parent process is acad.exe or maya.exe AND command line contains unusual parameters