{"id":"CVE-2023-41139","title":"A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer","summary":"A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.\n","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-822","CWE-119"],"vendor":"autodesk","product":"autocad","affected":["autocad < 2024.1","autocad >= 2023.0.0, < 2023.1.4","autocad >= 2024.0.0, < 2024.1.1","autocad_advance_steel < 2023.1.4","autocad_advance_steel >= 2024.0.0, < 2024.1.1","autocad_architecture < 2023.1.4","autocad_architecture >= 2024.0.0, < 2024.1.1","autocad_civil_3d < 2023.1.4","autocad_civil_3d >= 2024.0.0, < 2024.1.1","autocad_electrical < 2023.1.4","autocad_electrical >= 2024.0.0, < 2024.1.1","autocad_lt < 2023.1.4","autocad_lt < 2024.1","autocad_lt >= 2024.0.0, < 2024.1.1","autocad_map_3d < 2023.1.4","autocad_map_3d >= 2024.0.0, < 2024.1.1","autocad_mechanical < 2023.1.4","autocad_mechanical >= 2024.0.0, < 2024.1.1","autocad_mep < 2023.1.4","autocad_mep >= 2024.0.0, < 2024.1.1","autocad_plant_3d < 2023.1.4","autocad_plant_3d >= 2024.0.0, < 2024.1.1"],"patched":["autocad 2024.1.1","autocad_advance_steel 2024.1.1","autocad_architecture 2024.1.1","autocad_civil_3d 2024.1.1","autocad_electrical 2024.1.1","autocad_lt 2024.1.1","autocad_map_3d 2024.1.1","autocad_mechanical 2024.1.1","autocad_mep 2024.1.1","autocad_plant_3d 2024.1.1"],"published":"2023-11-23","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:17:24.803","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-41139","references":[{"url":"https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018","label":"psirt@autodesk.com"},{"url":"https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00275,"epssPercentile":0.18311,"ingestedAt":"2026-10-08T23:16:47.353Z","slug":"CVE-2023-41139","body":"## Overview\n\nA maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.\n\n\n## Affected\n\n- `autocad < 2024.1`\n- `autocad >= 2023.0.0, < 2023.1.4`\n- `autocad >= 2024.0.0, < 2024.1.1`\n- `autocad_advance_steel < 2023.1.4`\n- `autocad_advance_steel >= 2024.0.0, < 2024.1.1`\n- `autocad_architecture < 2023.1.4`\n- `autocad_architecture >= 2024.0.0, < 2024.1.1`\n- `autocad_civil_3d < 2023.1.4`\n- `autocad_civil_3d >= 2024.0.0, < 2024.1.1`\n- `autocad_electrical < 2023.1.4`\n- `autocad_electrical >= 2024.0.0, < 2024.1.1`\n- `autocad_lt < 2023.1.4`\n- `autocad_lt < 2024.1`\n- `autocad_lt >= 2024.0.0, < 2024.1.1`\n- `autocad_map_3d < 2023.1.4`\n- `autocad_map_3d >= 2024.0.0, < 2024.1.1`\n- `autocad_mechanical < 2023.1.4`\n- `autocad_mechanical >= 2024.0.0, < 2024.1.1`\n- `autocad_mep < 2023.1.4`\n- `autocad_mep >= 2024.0.0, < 2024.1.1`\n- `autocad_plant_3d < 2023.1.4`\n- `autocad_plant_3d >= 2024.0.0, < 2024.1.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `autocad 2024.1.1`\n- `autocad_advance_steel 2024.1.1`\n- `autocad_architecture 2024.1.1`\n- `autocad_civil_3d 2024.1.1`\n- `autocad_electrical 2024.1.1`\n- `autocad_lt 2024.1.1`\n- `autocad_map_3d 2024.1.1`\n- `autocad_mechanical 2024.1.1`\n- `autocad_mep 2024.1.1`\n- `autocad_plant_3d 2024.1.1`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}