CVE-2024-37002
High
Published: 25 June 2024
Published
25 June 2024
Modified
13 November 2025
KEV Added
—
Patch
—
CVSS Score v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
0.0015
35.3th percentile
Risk Priority
16
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2024-37002 is a high-severity Use of Uninitialized Variable (CWE-457) vulnerability in Autodesk Autocad. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 35.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36594
Vulnerability details
A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
autodesk
autocad
2022 — 2022.1.5 · 2023 — 2023.1.6 · 2024 — 2024.1.4
autodesk
autocad architecture
2022 — 2022.1.5 · 2023 — 2023.1.6 · 2024 — 2024.1.4
autodesk
autocad electrical
2022 — 2022.1.5 · 2023 — 2023.1.6 · 2024 — 2024.1.4
autodesk
autocad map 3d
2022 — 2022.1.5 · 2023 — 2023.1.6 · 2024 — 2024.1.4
autodesk
autocad mechanical
2022 — 2022.1.5 · 2023 — 2023.1.6 · 2024 — 2024.1.4
autodesk
autocad mep
2022 — 2022.1.5 · 2023 — 2023.1.6 · 2024 — 2024.1.4
autodesk
autocad plant 3d
2022 — 2022.1.5 · 2023 — 2023.1.6 · 2024 — 2024.1.4
autodesk
civil 3d
2022 — 2022.1.5 · 2023 — 2023.1.6 · 2024 — 2024.1.4
autodesk
advance steel
2022 — 2022.1.5 · 2023 — 2023.1.6 · 2024 — 2024.1.4
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.