CVE-2024-7991
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code by tricking users into opening malicious DWG files in Autodesk AutoCAD. It affects AutoCAD and AutoCAD-based products, potentially giving attackers full control over the affected system. Users who open untrusted DWG files are at risk.
💻 Affected Systems
- Autodesk AutoCAD
- AutoCAD-based products
📦 What is this software?
Autocad by Autodesk
Autocad Lt by Autodesk
Autocad Mep by Autodesk
Dwg Trueview by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash or limited data corruption from malicious files, with potential for targeted attacks against specific organizations.
If Mitigated
Application crash with no data loss if proper file validation and user awareness controls are implemented.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions specified in Autodesk advisory ADSK-SA-2024-0021
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0021
Restart Required: Yes
Instructions:
1. Visit Autodesk Trust Center. 2. Download latest security update for your AutoCAD version. 3. Install update. 4. Restart AutoCAD application.
🔧 Temporary Workarounds
Restrict DWG file handling
windowsConfigure AutoCAD to only open DWG files from trusted sources using application whitelisting
User awareness training
allTrain users to only open DWG files from trusted sources and verify file integrity
🧯 If You Can't Patch
- Implement application whitelisting to restrict AutoCAD execution to trusted locations only
- Deploy email/web filtering to block malicious DWG attachments and downloads
🔍 How to Verify
Check if Vulnerable:
Check AutoCAD version against affected versions in Autodesk advisory ADSK-SA-2024-0021Check Version:
In AutoCAD: Type 'ABOUT' command or check Help > About AutoCADVerify Fix Applied:
Verify AutoCAD version is updated to patched version specified in advisory📡 Detection & Monitoring
Log Indicators:
- AutoCAD crash logs with memory access violations
- Unexpected process termination events
Network Indicators:
- Unusual outbound connections from AutoCAD process
- File downloads of DWG files from untrusted sources
SIEM Query:
Process:AutoCAD.exe AND (EventID:1000 OR EventID:1001) AND ExceptionCode:c0000005