Vulnerability Description
A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by attackers to execute arbitrary code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Autodesk | Autocad | >= 2019, < 2019.1.4 |
| Autodesk | Autocad Advance Steel | >= 2019, < 2019.1.4 |
| Autodesk | Autocad Architecture | >= 2019, < 2019.1.4 |
| Autodesk | Autocad Civil 3D | >= 2019, < 2019.1.4 |
| Autodesk | Autocad Electrical | >= 2019, < 2019.1.4 |
| Autodesk | Autocad Lt | >= 2019, < 2019.1.4 |
| Autodesk | Autocad Map 3D | >= 2019, < 2019.1.4 |
| Autodesk | Autocad Mechanical | >= 2019, < 2019.1.4 |
| Autodesk | Autocad Mep | >= 2019, < 2019.1.4 |
| Autodesk | Autocad Plant 3D | >= 2019, < 2019.1.4 |
| Autodesk | Design Review | 2018 |
| Autodesk | Dwg Trueview | >= 2019, < 2019.1.4 |
| Autodesk | Fusion | >= 2.0.10356, < 2.0.11405 |
| Autodesk | Infrastructure Parts Editor | >= 2019, < 2019.2.2 |
| Autodesk | Infraworks | >= 2019, < 2019.3 |
| Autodesk | Inventor | >= 2019, < 2019.6 |
| Autodesk | Navisworks | >= 2019, < 2019.7 |
| Autodesk | Revit | >= 2019, < 2019.2.4 |
| Autodesk | Storm And Sanitary Analysis | >= 2020, < 2020.3.1 |
Related Weaknesses (CWE)
References
- https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011Vendor Advisory
- https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011Vendor Advisory
FAQ
What is CVE-2021-40166?
CVE-2021-40166 is a vulnerability with a CVSS score of 7.8 (HIGH). A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by at...
How severe is CVE-2021-40166?
CVE-2021-40166 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-40166?
Check the references section above for vendor advisories and patch information. Affected products include: Autodesk Autocad, Autodesk Autocad Advance Steel, Autodesk Autocad Architecture, Autodesk Autocad Civil 3D, Autodesk Autocad Electrical.