CVE-2019-7364
HighCVSS 7.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D and version 2017 of AutoCAD P&ID.
Risk Assessment
An attacker may trick a user into opening a malicious DWG file that may leverage a DLL preloading vulnerability in AutoCAD which may result in code execution.
Recommendation
Update Autodesk software to the latest version containing the fix or apply the vendor's security recommendations.
Other vulnerabilities in Autodesk AutoCAD
See all- CVE-2023-29074Critical
A vulnerability in Autodesk AutoCAD 2024 and 2023 involves an out-of-bounds write when parsing a maliciously crafted CATPART file. An attacker can exploit this to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- CVE-2023-29073Critical
A vulnerability in Autodesk AutoCAD 2024 and 2023 involves a heap-based buffer overflow when parsing a maliciously crafted MODEL file. An attacker can exploit this to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- CVE-2026-17550Medium
An Out-of-Bounds Read vulnerability in Autodesk AutoCAD when parsing a maliciously crafted DWG or DXF file can cause a crash or disclose sensitive information.
- CVE-2026-16465Medium
An Out-of-Bounds Read vulnerability in Autodesk AutoCAD when parsing a maliciously crafted DWG or DXF file can cause a crash or disclose sensitive information.
- CVE-2026-16463High
A Heap-Based Overflow vulnerability in Autodesk AutoCAD occurs when parsing a maliciously crafted DXF file. An attacker can exploit this to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- CVE-2023-41140High
A maliciously crafted PRT file parsed through Autodesk AutoCAD 2024 and 2023 can cause a heap-based buffer overflow. An attacker can leverage this to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- CVE-2023-41139High
A specially crafted STP file parsed through Autodesk AutoCAD 2024 and 2023 can cause an untrusted pointer dereference. This vulnerability, along with others, could lead to code execution in the current process.
- CVE-2022-27867High
A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can trigger a use-after-free vulnerability. Exploitation may lead to code execution.
- CVE-2022-25788High
A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files. This vulnerability can be exploited to execute arbitrary code.
Original NVD description (English source)
DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D and version 2017 of AutoCAD P&ID. An attacker may trick a user into opening a malicious DWG file that may leverage a DLL preloading vulnerability in AutoCAD which may result in code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS