---
id: CVE-2023-41139
title: >-
  A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and
  2023 can be used to dereference an untrusted pointer
summary: >
  A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and
  2023 can be used to dereference an untrusted pointer. This vulnerability,
  along with other vulnerabilities, could lead to code execution in the current
  process.
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-822
  - CWE-119
vendor: autodesk
product: autocad
affected:
  - autocad < 2024.1
  - 'autocad >= 2023.0.0, < 2023.1.4'
  - 'autocad >= 2024.0.0, < 2024.1.1'
  - autocad_advance_steel < 2023.1.4
  - 'autocad_advance_steel >= 2024.0.0, < 2024.1.1'
  - autocad_architecture < 2023.1.4
  - 'autocad_architecture >= 2024.0.0, < 2024.1.1'
  - autocad_civil_3d < 2023.1.4
  - 'autocad_civil_3d >= 2024.0.0, < 2024.1.1'
  - autocad_electrical < 2023.1.4
  - 'autocad_electrical >= 2024.0.0, < 2024.1.1'
  - autocad_lt < 2023.1.4
  - autocad_lt < 2024.1
  - 'autocad_lt >= 2024.0.0, < 2024.1.1'
  - autocad_map_3d < 2023.1.4
  - 'autocad_map_3d >= 2024.0.0, < 2024.1.1'
  - autocad_mechanical < 2023.1.4
  - 'autocad_mechanical >= 2024.0.0, < 2024.1.1'
  - autocad_mep < 2023.1.4
  - 'autocad_mep >= 2024.0.0, < 2024.1.1'
  - autocad_plant_3d < 2023.1.4
  - 'autocad_plant_3d >= 2024.0.0, < 2024.1.1'
patched:
  - autocad 2024.1.1
  - autocad_advance_steel 2024.1.1
  - autocad_architecture 2024.1.1
  - autocad_civil_3d 2024.1.1
  - autocad_electrical 2024.1.1
  - autocad_lt 2024.1.1
  - autocad_map_3d 2024.1.1
  - autocad_mechanical 2024.1.1
  - autocad_mep 2024.1.1
  - autocad_plant_3d 2024.1.1
published: '2023-11-23'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T22:17:24.803'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-41139'
references:
  - url: 'https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018'
    label: psirt@autodesk.com
  - url: 'https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0018'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00275
epssPercentile: 0.18311
ingestedAt: '2026-10-08T23:16:47.353Z'
---

## Overview

A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.


## Affected

- `autocad < 2024.1`
- `autocad >= 2023.0.0, < 2023.1.4`
- `autocad >= 2024.0.0, < 2024.1.1`
- `autocad_advance_steel < 2023.1.4`
- `autocad_advance_steel >= 2024.0.0, < 2024.1.1`
- `autocad_architecture < 2023.1.4`
- `autocad_architecture >= 2024.0.0, < 2024.1.1`
- `autocad_civil_3d < 2023.1.4`
- `autocad_civil_3d >= 2024.0.0, < 2024.1.1`
- `autocad_electrical < 2023.1.4`
- `autocad_electrical >= 2024.0.0, < 2024.1.1`
- `autocad_lt < 2023.1.4`
- `autocad_lt < 2024.1`
- `autocad_lt >= 2024.0.0, < 2024.1.1`
- `autocad_map_3d < 2023.1.4`
- `autocad_map_3d >= 2024.0.0, < 2024.1.1`
- `autocad_mechanical < 2023.1.4`
- `autocad_mechanical >= 2024.0.0, < 2024.1.1`
- `autocad_mep < 2023.1.4`
- `autocad_mep >= 2024.0.0, < 2024.1.1`
- `autocad_plant_3d < 2023.1.4`
- `autocad_plant_3d >= 2024.0.0, < 2024.1.1`

## Remediation

Upgrade past the affected range:

- `autocad 2024.1.1`
- `autocad_advance_steel 2024.1.1`
- `autocad_architecture 2024.1.1`
- `autocad_civil_3d 2024.1.1`
- `autocad_electrical 2024.1.1`
- `autocad_lt 2024.1.1`
- `autocad_map_3d 2024.1.1`
- `autocad_mechanical 2024.1.1`
- `autocad_mep 2024.1.1`
- `autocad_plant_3d 2024.1.1`