CVE-2023-25003

Published: Jun 23, 2023Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulnerabilities. Exploitation of this vulnerability may lead to code execution.

Affected (53)

Products: Autodesk: Alias, Autocad, Autocad Advance Steel, Autocad Architecture, Autocad Civil 3d, Autocad Electrical, Autocad Lt, Autocad Map 3d, Autocad Mechanical, Autocad Mep, Autocad Plant 3d, Infraworks, Inventor, Maya Usd, Navisworks, Revit, Vred

Autodesk

17 products

Alias

Autocad

Autocad Advance Steel

Configuration A

53 vulnerable

Vulnerable Software	Affected Versions
Autodesk Alias	2023 ≤ version < 2023.1.1
Autodesk Autocad	2020 ≤ version < 2020.1.6
Autodesk Autocad	2021 ≤ version < 2021.1.3
Autodesk Autocad	2022 ≤ version < 2022.1.3
Autodesk Autocad	2023 ≤ version < 2023.1.1
Autodesk Autocad Advance Steel	2020 ≤ version < 2020.1.6
Autodesk Autocad Advance Steel	2021 ≤ version < 2021.1.3
Autodesk Autocad Advance Steel	2022 ≤ version < 2022.1.3
Autodesk Autocad Advance Steel	2023 ≤ version < 2023.1.1
Autodesk Autocad Architecture	2020 ≤ version < 2020.1.6
Autodesk Autocad Architecture	2021 ≤ version < 2021.1.3
Autodesk Autocad Architecture	2022 ≤ version < 2022.1.3
Autodesk Autocad Architecture	2023 ≤ version < 2023.1.1
Autodesk Autocad Civil 3d	2020 ≤ version < 2020.1.6
Autodesk Autocad Civil 3d	2021 ≤ version < 2021.1.3
Autodesk Autocad Civil 3d	2022 ≤ version < 2022.1.3
Autodesk Autocad Civil 3d	2023 ≤ version < 2023.1.1
Autodesk Autocad Electrical	2020 ≤ version < 2020.1.6
Autodesk Autocad Electrical	2021 ≤ version < 2021.1.3
Autodesk Autocad Electrical	2022 ≤ version < 2022.1.3
Autodesk Autocad Electrical	2023 ≤ version < 2023.1.1
Autodesk Autocad Lt	2020 ≤ version < 2020.1.6
Autodesk Autocad Lt	2021 ≤ version < 2021.1.3
Autodesk Autocad Lt	2022 ≤ version < 2022.1.3
Autodesk Autocad Lt	2023 ≤ version < 2023.1.1
Autodesk Autocad Map 3d	2020 ≤ version < 2020.1.6
Autodesk Autocad Map 3d	2021 ≤ version < 2021.1.3
Autodesk Autocad Map 3d	2022 ≤ version < 2022.1.3
Autodesk Autocad Map 3d	2023 ≤ version < 2023.1.1
Autodesk Autocad Mechanical	2020 ≤ version < 2020.1.6
Autodesk Autocad Mechanical	2021 ≤ version < 2021.1.3
Autodesk Autocad Mechanical	2022 ≤ version < 2022.1.3
Autodesk Autocad Mechanical	2023 ≤ version < 2023.1.1
Autodesk Autocad Mep	2020 ≤ version < 2020.1.6
Autodesk Autocad Mep	2021 ≤ version < 2021.1.3
Autodesk Autocad Mep	2022 ≤ version < 2022.1.3
Autodesk Autocad Mep	2023 ≤ version < 2023.1.1
Autodesk Autocad Plant 3d	2020 ≤ version < 2020.1.6
Autodesk Autocad Plant 3d	2021 ≤ version < 2021.1.3
Autodesk Autocad Plant 3d	2022 ≤ version < 2022.1.3
Autodesk Autocad Plant 3d	2023 ≤ version < 2023.1.1
Autodesk Infraworks	2021 ≤ version < 2021.2
Autodesk Infraworks	2022 ≤ version < 2022.1
Autodesk Infraworks	2023 ≤ version < 2023.1
Autodesk Inventor	2021 ≤ version < 2021.5
Autodesk Inventor	2022 ≤ version < 2022.4
Autodesk Inventor	2023 ≤ version < 2023.3.1
Autodesk Maya Usd	2022 ≤ version < 2022.5
Autodesk Maya Usd	2023 ≤ version < 2023.3
Autodesk Navisworks	2022 ≤ version < 2022.4
Autodesk Navisworks	2023 ≤ version < 2023.2
Autodesk Revit	2021 ≤ version < 2021.1.8
Autodesk Vred	2023 ≤ version < 2023.4

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009

Source: psirt@autodesk.com

Vendor Advisory

https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.