Vulnerability in Autodesk Advance Steel
CVE-2024-23136
A maliciously crafted STP file in ASMKERN228A.dll when parsed through Autodesk applications can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
EPSS: 0.004 (36.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Autodesk Advance Steel — versions 2025, 2024, 2023
- Autodesk Advance_steel
- Autodesk Autocad — versions 2025, 2024, 2023
- Autodesk Autocad Architecture — versions 2025, 2024, 2023
- Autodesk Autocad_architecture
- Autodesk Autocad Electrical — versions 2025, 2024, 2023
- Autodesk Autocad_electrical
- Autodesk Autocad Map 3d — versions 2025, 2024, 2023
- Autodesk Autocad_map_3d
- Autodesk Autocad Mechanical — versions 2025, 2024, 2023
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@autodesk.com (Vendor Advisory)
- psirt@autodesk.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-23136?
- CVE-2024-23136 is a high-severity vulnerability in Autodesk Advance Steel, classified under Untrusted Pointer Dereference. CVSS score: 7.8/10. Published 2024-02-22.
- How severe is CVE-2024-23136?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2024-23136 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.