Buffer overflow in Autodesk Autocad
CVE-2022-42940
A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (31.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 31.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Autodesk Autocad — versions 2019, 2020, 2021
- Autodesk Autocad Advance Steel — versions 2019, 2020, 2021
- Autodesk Autocad Architecture — versions 2019, 2020, 2021
- Autodesk Autocad Civil 3d — versions 2019, 2020, 2021
- Autodesk Autocad Electrical — versions 2019, 2020, 2021
- Autodesk Autocad Lt — versions 2019, 2020, 2021
- Autodesk Autocad Map 3d — versions 2019, 2020, 2021
- Autodesk Autocad Mechanical — versions 2019, 2020, 2021
- Autodesk Autocad Mep — versions 2019, 2020, 2021
- Autodesk Autocad Plant 3d — versions 2019, 2020, 2021
Weakness classification (CWE)
References
- www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004 (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-42940?
- CVE-2022-42940 is a high-severity vulnerability in Autodesk Autocad, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2022-10-21.
- How severe is CVE-2022-42940?
- High severity. CVSS v3 base score is 7.8 out of 10.