{"id":"CVE-2024-37002","aliases":["EUVD-2024-36594","GHSA-354c-38ff-3cw6"],"status":"published","title":"Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software","description":"A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00386,"percentile":0.32928,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-457","CWE-863","CWE-908"],"published":"2024-06-25T03:07:28Z","modified":"2026-06-17T07:37:34Z","products":[{"vendor":"autodesk","product":"advance steel"},{"vendor":"autodesk","product":"advance_steel"},{"vendor":"autodesk","product":"autocad"},{"vendor":"autodesk","product":"autocad architecture"},{"vendor":"autodesk","product":"autocad electrical"},{"vendor":"autodesk","product":"autocad map 3d"},{"vendor":"autodesk","product":"autocad mechanical"},{"vendor":"autodesk","product":"autocad mep"},{"vendor":"autodesk","product":"autocad plant 3d"},{"vendor":"autodesk","product":"autocad_architecture"},{"vendor":"autodesk","product":"autocad_electrical"},{"vendor":"autodesk","product":"autocad_map_3d"},{"vendor":"autodesk","product":"autocad_mechanical"},{"vendor":"autodesk","product":"autocad_mep"},{"vendor":"autodesk","product":"autocad_plant_3d"},{"vendor":"autodesk","product":"civil 3d"},{"vendor":"autodesk","product":"civil_3d"}],"references":[{"url":"https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37002"},{"url":"https://github.com/advisories/GHSA-354c-38ff-3cw6"}],"sources":{"cve":[{"id":"CVE-2024-37002","title":"Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software","description":"A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.","status":"published","published":"2024-06-25T03:07:28.673Z","modified":"2025-08-27T21:14:27.526Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-457"],"updated_at":"2026-11-02T14:34:00.585327Z"}],"euvd":[{"id":"EUVD-2024-36594","description":"A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.","status":"published","published":"2024-06-25T03:07:28Z","modified":"2025-08-27T21:14:27Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:50.600254Z"}],"ghsa":[{"id":"GHSA-354c-38ff-3cw6","title":"A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications,...","description":"A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.","status":"published","published":"2024-06-25T03:31:07Z","modified":"2025-11-13T21:31:13Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-457","CWE-863","CWE-908"],"updated_at":"2026-11-02T15:04:47.510067Z"}],"nvd":[{"id":"CVE-2024-37002","description":"A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.","status":"published","published":"2024-06-25T03:15:10.647Z","modified":"2026-06-17T07:37:34.743Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-457","CWE-908"],"updated_at":"2026-11-02T14:10:09.388795Z"}]}}