CVE-2024-23146
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code or cause crashes by tricking AutoCAD into processing malicious X_B and X_T files. It affects AutoCAD users who open untrusted CAD files. The vulnerability exists in pskernel.DLL and can be exploited without authentication.
💻 Affected Systems
- Autodesk AutoCAD
📦 What is this software?
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Advance Steel by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Autocad Mep by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
Civil 3d by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the same privileges as the AutoCAD process, potentially leading to full system compromise.
Likely Case
Application crashes and denial of service when processing malicious files, with potential for limited code execution.
If Mitigated
Limited impact if users only open trusted files and AutoCAD runs with restricted privileges.
🎯 Exploit Status
Exploitation requires user interaction to open malicious files, but no authentication is needed once the file is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Autodesk Security Advisory ADSK-SA-2024-0009 for specific patched versions
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009
Restart Required: Yes
Instructions:
1. Open AutoCAD. 2. Navigate to Help > About. 3. Check for updates. 4. Install available security updates. 5. Restart AutoCAD.
🔧 Temporary Workarounds
Restrict file types
windowsBlock or restrict opening of X_B and X_T files through group policy or application whitelisting.
Run with reduced privileges
allConfigure AutoCAD to run with limited user privileges to reduce impact of successful exploitation.
🧯 If You Can't Patch
- Implement strict file handling policies: only open CAD files from trusted sources
- Use application sandboxing or virtualization to isolate AutoCAD from critical systems
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version against affected versions listed in Autodesk Security Advisory ADSK-SA-2024-0009Check Version:
In AutoCAD: Help > About, or check Windows Programs and Features for version informationVerify Fix Applied:
Verify AutoCAD version is updated to patched version specified in the security advisory📡 Detection & Monitoring
Log Indicators:
- AutoCAD crash logs with pskernel.DLL errors
- Unexpected file parsing errors in application logs
Network Indicators:
- Downloads of X_B or X_T files from untrusted sources
SIEM Query:
source="autocad.log" AND (error OR crash) AND pskernel.DLL