CVE-2024-7675

DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software

CVSS 7.8 HIGHEPSS 0.2%CWE-416

A maliciously crafted DWF file, when parsed in w3dtk.dll through Autodesk Navisworks, can force a Use-After-Free. A malicious actor can leverage this vulnerability to cause a crash or execute arbitrary code in the context of the current process.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Autodesk · Navisworks Freedom Autodesk · Navisworks Manage Autodesk · Navisworks Simulate

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0015