Search
Find a vulnerability
Search criteria
46 vulnerabilities found for Navisworks Manage by Autodesk
CVE-2025-1660 (GCVE-0-2025-1660)
Vulnerability from nvd – Published: 2025-04-01 12:29 – Updated: 2026-02-26 18:29
VLAI
Title
DWFX File Parsing Memory Corruption Vulnerability
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1660",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-25T03:55:21.378230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:29:03.568Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-19T13:14:04.769Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0002"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Memory Corruption Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2025-1660",
"datePublished": "2025-04-01T12:29:20.944Z",
"dateReserved": "2025-02-24T20:15:55.160Z",
"dateUpdated": "2026-02-26T18:29:03.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1659 (GCVE-0-2025-1659)
Vulnerability from nvd – Published: 2025-04-01 12:28 – Updated: 2026-02-26 18:29
VLAI
Title
DWFX File Parsing Out-of-Bounds Read Vulnerability
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-Bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1659",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-25T03:55:27.014028Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:29:05.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-19T13:13:38.044Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0002"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Out-of-Bounds Read Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2025-1659",
"datePublished": "2025-04-01T12:28:06.627Z",
"dateReserved": "2025-02-24T20:15:54.081Z",
"dateUpdated": "2026-02-26T18:29:05.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1658 (GCVE-0-2025-1658)
Vulnerability from nvd – Published: 2025-04-01 12:27 – Updated: 2026-02-26 18:29
VLAI
Title
DWFX File Parsing Out-of-Bounds Read Vulnerability
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-Bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-25T03:55:28.368698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:29:05.249Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-19T13:13:21.792Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0002"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Out-of-Bounds Read Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2025-1658",
"datePublished": "2025-04-01T12:27:24.602Z",
"dateReserved": "2025-02-24T20:15:53.141Z",
"dateUpdated": "2026-02-26T18:29:05.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-12671 (GCVE-0-2024-12671)
Vulnerability from nvd – Published: 2024-12-17 15:28 – Updated: 2025-08-26 17:17
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12671",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:45:56.846039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:46:05.397Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T17:17:18.928Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12671",
"datePublished": "2024-12-17T15:28:48.438Z",
"dateReserved": "2024-12-16T14:52:33.930Z",
"dateUpdated": "2025-08-26T17:17:18.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12670 (GCVE-0-2024-12670)
Vulnerability from nvd – Published: 2024-12-17 15:28 – Updated: 2025-08-26 17:17
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:46:17.014347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:46:52.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T17:17:03.296Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12670",
"datePublished": "2024-12-17T15:28:05.933Z",
"dateReserved": "2024-12-16T14:41:31.535Z",
"dateUpdated": "2025-08-26T17:17:03.296Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12669 (GCVE-0-2024-12669)
Vulnerability from nvd – Published: 2024-12-17 15:27 – Updated: 2025-08-26 17:16
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:55:15.741934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:55:46.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T17:16:46.311Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12669",
"datePublished": "2024-12-17T15:27:17.052Z",
"dateReserved": "2024-12-16T14:24:34.883Z",
"dateUpdated": "2025-08-26T17:16:46.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12200 (GCVE-0-2024-12200)
Vulnerability from nvd – Published: 2024-12-17 15:26 – Updated: 2025-08-26 16:56
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12200",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:55:56.194600Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:56:09.767Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:56:42.734Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12200",
"datePublished": "2024-12-17T15:26:28.404Z",
"dateReserved": "2024-12-04T17:09:35.223Z",
"dateUpdated": "2025-08-26T16:56:42.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12199 (GCVE-0-2024-12199)
Vulnerability from nvd – Published: 2024-12-17 15:24 – Updated: 2025-08-26 16:56
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12199",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:56:24.600977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:59:42.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:56:27.244Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12199",
"datePublished": "2024-12-17T15:24:15.296Z",
"dateReserved": "2024-12-04T17:08:43.647Z",
"dateUpdated": "2025-08-26T16:56:27.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12198 (GCVE-0-2024-12198)
Vulnerability from nvd – Published: 2024-12-17 15:22 – Updated: 2025-08-26 16:56
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:59:53.039934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T16:00:06.771Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:56:00.736Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12198",
"datePublished": "2024-12-17T15:22:49.565Z",
"dateReserved": "2024-12-04T17:07:49.179Z",
"dateUpdated": "2025-08-26T16:56:00.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12197 (GCVE-0-2024-12197)
Vulnerability from nvd – Published: 2024-12-17 15:21 – Updated: 2025-08-26 16:55
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T16:00:18.108656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T16:00:26.418Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:55:38.680Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12197",
"datePublished": "2024-12-17T15:21:43.044Z",
"dateReserved": "2024-12-04T17:05:00.492Z",
"dateUpdated": "2025-08-26T16:55:38.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12194 (GCVE-0-2024-12194)
Vulnerability from nvd – Published: 2024-12-17 15:20 – Updated: 2025-08-26 16:55
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12194",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T16:00:36.826047Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T16:00:47.336Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:55:20.829Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12194",
"datePublished": "2024-12-17T15:20:17.674Z",
"dateReserved": "2024-12-04T17:03:52.996Z",
"dateUpdated": "2025-08-26T16:55:20.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12193 (GCVE-0-2024-12193)
Vulnerability from nvd – Published: 2024-12-17 15:18 – Updated: 2025-08-26 16:54
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:35:43.313638Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:37:12.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:54:55.956Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12193",
"datePublished": "2024-12-17T15:18:38.961Z",
"dateReserved": "2024-12-04T17:02:44.990Z",
"dateUpdated": "2025-08-26T16:54:55.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12192 (GCVE-0-2024-12192)
Vulnerability from nvd – Published: 2024-12-17 15:17 – Updated: 2025-08-26 16:54
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWF file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:33:49.813338Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:34:02.527Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWF file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWF file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:54:28.551Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12192",
"datePublished": "2024-12-17T15:17:56.627Z",
"dateReserved": "2024-12-04T17:01:22.228Z",
"dateUpdated": "2025-08-26T16:54:28.551Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12191 (GCVE-0-2024-12191)
Vulnerability from nvd – Published: 2024-12-17 15:17 – Updated: 2025-08-26 16:53
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:34:49.276077Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:34:57.310Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:53:52.322Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12191",
"datePublished": "2024-12-17T15:17:15.621Z",
"dateReserved": "2024-12-04T17:00:16.111Z",
"dateUpdated": "2025-08-26T16:53:52.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12179 (GCVE-0-2024-12179)
Vulnerability from nvd – Published: 2024-12-17 15:19 – Updated: 2025-08-26 16:53
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12179",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:30:23.695137Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:31:25.599Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:53:27.682Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12179",
"datePublished": "2024-12-17T15:19:29.587Z",
"dateReserved": "2024-12-04T16:30:45.791Z",
"dateUpdated": "2025-08-26T16:53:27.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12178 (GCVE-0-2024-12178)
Vulnerability from nvd – Published: 2024-12-17 15:16 – Updated: 2026-01-22 14:21
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:36:10.207026Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:36:28.205Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T14:21:21.091Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12178",
"datePublished": "2024-12-17T15:16:31.988Z",
"dateReserved": "2024-12-04T16:29:28.425Z",
"dateUpdated": "2026-01-22T14:21:21.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-11422 (GCVE-0-2024-11422)
Vulnerability from nvd – Published: 2024-12-17 15:15 – Updated: 2025-08-26 16:51
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:*:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:*:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11422",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T16:01:00.524165Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T16:03:52.756Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(248, 248, 248);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Write v\u003c/span\u003eulnerability\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e. A malicious actor can leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:51:33.111Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-11422",
"datePublished": "2024-12-17T15:15:17.614Z",
"dateReserved": "2024-11-19T15:06:04.744Z",
"dateUpdated": "2025-08-26T16:51:33.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-1660 (GCVE-0-2025-1660)
Vulnerability from cvelistv5 – Published: 2025-04-01 12:29 – Updated: 2026-02-26 18:29
VLAI
Title
DWFX File Parsing Memory Corruption Vulnerability
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1660",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-25T03:55:21.378230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:29:03.568Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-19T13:14:04.769Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0002"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Memory Corruption Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2025-1660",
"datePublished": "2025-04-01T12:29:20.944Z",
"dateReserved": "2025-02-24T20:15:55.160Z",
"dateUpdated": "2026-02-26T18:29:03.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1659 (GCVE-0-2025-1659)
Vulnerability from cvelistv5 – Published: 2025-04-01 12:28 – Updated: 2026-02-26 18:29
VLAI
Title
DWFX File Parsing Out-of-Bounds Read Vulnerability
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-Bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1659",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-25T03:55:27.014028Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:29:05.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-19T13:13:38.044Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0002"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Out-of-Bounds Read Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2025-1659",
"datePublished": "2025-04-01T12:28:06.627Z",
"dateReserved": "2025-02-24T20:15:54.081Z",
"dateUpdated": "2026-02-26T18:29:05.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1658 (GCVE-0-2025-1658)
Vulnerability from cvelistv5 – Published: 2025-04-01 12:27 – Updated: 2026-02-26 18:29
VLAI
Title
DWFX File Parsing Out-of-Bounds Read Vulnerability
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-Bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.5
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-25T03:55:28.368698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:29:05.249Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.5",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-19T13:13:21.792Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0002"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Out-of-Bounds Read Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2025-1658",
"datePublished": "2025-04-01T12:27:24.602Z",
"dateReserved": "2025-02-24T20:15:53.141Z",
"dateUpdated": "2026-02-26T18:29:05.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-12671 (GCVE-0-2024-12671)
Vulnerability from cvelistv5 – Published: 2024-12-17 15:28 – Updated: 2025-08-26 17:17
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12671",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:45:56.846039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:46:05.397Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T17:17:18.928Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12671",
"datePublished": "2024-12-17T15:28:48.438Z",
"dateReserved": "2024-12-16T14:52:33.930Z",
"dateUpdated": "2025-08-26T17:17:18.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12670 (GCVE-0-2024-12670)
Vulnerability from cvelistv5 – Published: 2024-12-17 15:28 – Updated: 2025-08-26 17:17
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:46:17.014347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:46:52.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T17:17:03.296Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12670",
"datePublished": "2024-12-17T15:28:05.933Z",
"dateReserved": "2024-12-16T14:41:31.535Z",
"dateUpdated": "2025-08-26T17:17:03.296Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12669 (GCVE-0-2024-12669)
Vulnerability from cvelistv5 – Published: 2024-12-17 15:27 – Updated: 2025-08-26 17:16
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:55:15.741934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:55:46.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T17:16:46.311Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12669",
"datePublished": "2024-12-17T15:27:17.052Z",
"dateReserved": "2024-12-16T14:24:34.883Z",
"dateUpdated": "2025-08-26T17:16:46.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12200 (GCVE-0-2024-12200)
Vulnerability from cvelistv5 – Published: 2024-12-17 15:26 – Updated: 2025-08-26 16:56
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12200",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:55:56.194600Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:56:09.767Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:56:42.734Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12200",
"datePublished": "2024-12-17T15:26:28.404Z",
"dateReserved": "2024-12-04T17:09:35.223Z",
"dateUpdated": "2025-08-26T16:56:42.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12199 (GCVE-0-2024-12199)
Vulnerability from cvelistv5 – Published: 2024-12-17 15:24 – Updated: 2025-08-26 16:56
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12199",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:56:24.600977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:59:42.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:56:27.244Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12199",
"datePublished": "2024-12-17T15:24:15.296Z",
"dateReserved": "2024-12-04T17:08:43.647Z",
"dateUpdated": "2025-08-26T16:56:27.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12198 (GCVE-0-2024-12198)
Vulnerability from cvelistv5 – Published: 2024-12-17 15:22 – Updated: 2025-08-26 16:56
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:59:53.039934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T16:00:06.771Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:56:00.736Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12198",
"datePublished": "2024-12-17T15:22:49.565Z",
"dateReserved": "2024-12-04T17:07:49.179Z",
"dateUpdated": "2025-08-26T16:56:00.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12197 (GCVE-0-2024-12197)
Vulnerability from cvelistv5 – Published: 2024-12-17 15:21 – Updated: 2025-08-26 16:55
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T16:00:18.108656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T16:00:26.418Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:55:38.680Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12197",
"datePublished": "2024-12-17T15:21:43.044Z",
"dateReserved": "2024-12-04T17:05:00.492Z",
"dateUpdated": "2025-08-26T16:55:38.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12194 (GCVE-0-2024-12194)
Vulnerability from cvelistv5 – Published: 2024-12-17 15:20 – Updated: 2025-08-26 16:55
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12194",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T16:00:36.826047Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T16:00:47.336Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:55:20.829Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12194",
"datePublished": "2024-12-17T15:20:17.674Z",
"dateReserved": "2024-12-04T17:03:52.996Z",
"dateUpdated": "2025-08-26T16:55:20.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12179 (GCVE-0-2024-12179)
Vulnerability from cvelistv5 – Published: 2024-12-17 15:19 – Updated: 2025-08-26 16:53
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12179",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:30:23.695137Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:31:25.599Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:53:27.682Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12179",
"datePublished": "2024-12-17T15:19:29.587Z",
"dateReserved": "2024-12-04T16:30:45.791Z",
"dateUpdated": "2025-08-26T16:53:27.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12193 (GCVE-0-2024-12193)
Vulnerability from cvelistv5 – Published: 2024-12-17 15:18 – Updated: 2025-08-26 16:54
VLAI
Title
DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
Summary
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Navisworks Freedom |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Simulate |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:* |
|
| Autodesk | Navisworks Manage |
Affected:
2025 , < 2025.4
(custom)
cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-17T15:35:43.313638Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-17T15:37:12.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_freedom:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Freedom",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_simulate:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Simulate",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:navisworks_manage:2025:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "Navisworks Manage",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2025.4",
"status": "affected",
"version": "2025",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-26T16:54:55.956Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2024-12193",
"datePublished": "2024-12-17T15:18:38.961Z",
"dateReserved": "2024-12-04T17:02:44.990Z",
"dateUpdated": "2025-08-26T16:54:55.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}