Use After Free in Autodesk Advance Steel
CVE-2019-7360
An exploitable use-after-free vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file may trigger a use-after-free, resulting in code execution.
Vulnerability class: Use-After-Free
EPSS: 0.016 (74.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Autodesk Advance_steel — versions 2018
- Autodesk Autocad — versions 2018
- Autodesk Autocad_architecture — versions 2018
- Autodesk Autocad_electrical — versions 2018
- Autodesk Autocad_lt — versions 2018
- Autodesk Autocad_map_3d — versions 2018
- Autodesk Autocad_mechanical — versions 2018
- Autodesk Autocad_mep — versions 2018
- Autodesk Autocad_p\&id — versions 2018
- Autodesk Autocad_plant_3d — versions 2018
Weakness classification (CWE)
References
- psirt@autodesk.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-7360?
- CVE-2019-7360 is a high-severity vulnerability in Autodesk Advance Steel, classified under Use After Free. CVSS score: 7.8/10. Published 2019-04-09.
- How severe is CVE-2019-7360?
- High severity. CVSS v3 base score is 7.8 out of 10.