CVE-2024-12670

A maliciously crafted DWF file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:autodesk:navisworks:*:*:*:*:*:*:*:*

History

08 May 2025, 15:31

Type	Values Removed	Values Added
CWE		CWE-787
First Time		Autodesk navisworks Autodesk
References	~~() https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027 -~~	() https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027 - Vendor Advisory
CPE		cpe:2.3:a:autodesk:navisworks::::::::

29 Jan 2025, 17:15

Type	Values Removed	Values Added
Summary		(es) Un archivo DWF manipulado con fines malintencionados, cuando se analiza a través de Autodesk Navisworks, se puede utilizar para provocar una vulnerabilidad de desbordamiento basado en el montón. Un actor malintencionado puede aprovechar esta vulnerabilidad para provocar un bloqueo, leer datos confidenciales o ejecutar código arbitrario en el contexto del proceso actual.
References	~~{'url': 'https://autodesk.com/trust/security-advisories/adsk-sa-2024-0027', 'source': 'psirt@autodesk.com'}~~	() https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027 -

17 Dec 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-17 16:15

Updated : 2025-05-08 15:31

NVD link : CVE-2024-12670

Mitre link : CVE-2024-12670

CVE.ORG link : CVE-2024-12670

JSON object : View

Products Affected

autodesk

navisworks

CWE

CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2024-12670", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@autodesk.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-12-17T16:15:25.140", "references": [{"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027", "tags": ["Vendor Advisory"], "source": "psirt@autodesk.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@autodesk.com", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted DWF file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."}, {"lang": "es", "value": "Un archivo DWF manipulado con fines malintencionados, cuando se analiza a trav\u00e9s de Autodesk Navisworks, se puede utilizar para provocar una vulnerabilidad de desbordamiento basado en el mont\u00f3n. Un actor malintencionado puede aprovechar esta vulnerabilidad para provocar un bloqueo, leer datos confidenciales o ejecutar c\u00f3digo arbitrario en el contexto del proceso actual."}], "lastModified": "2025-05-08T15:31:32.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:navisworks:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DCC9A7C-617A-4E00-95CE-CF5A241C0F97", "versionEndExcluding": "2025.4", "versionStartIncluding": "2025"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@autodesk.com"}