CVE-2023-41139: A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference a

Routine

HIGH 7.8UPGRADEUPGRADEUPGRADE

CVE-2023-41139 is a high-severity flaw (CVSS 7.8) affecting autocad, autocad, autocad advance steel. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.3% (top 80%)
CISA exploited list	No
Weakness	CWE-822, CWE-119
Published	2023-11-23
Last modified	2026-10-08

Publisher (CNA): Autodesk · Vendor: autodesk

Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-11-23 04:15 UTCPublished CVE record published
2026-10-08 22:17 UTCUpdated Record last modified

autodesk autocad UPGRADE

Affected: < 2024.1

Fixed in: 2024.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy autocad || rpm -q autocad || autocad --version

2. UPGRADE to 2024.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade autocad

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade autocad

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

autodesk autocad UPGRADE

Affected: >= 2023.0.0 and < 2023.1.4 · >= 2024.0.0 and < 2024.1.1

Fixed in: 2023.1.4, 2024.1.1

Safe to downgrade to: a release before 2023.0.0

1. Check installed version

apt-cache policy autocad || rpm -q autocad || autocad --version

2. UPGRADE to 2023.1.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade autocad

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade autocad

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2023.0.0 (Debian / Ubuntu)

apt-cache madison autocad sudo apt install autocad=<VERSION_BEFORE_2023.0.0> sudo apt-mark hold autocad

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list autocad sudo dnf downgrade autocad-<VERSION_BEFORE_2023.0.0> sudo dnf versionlock add autocad

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

autodesk autocad advance steel UPGRADE

Affected: < 2023.1.4 · >= 2024.0.0 and < 2024.1.1

Fixed in: 2023.1.4, 2024.1.1

Safe to downgrade to: a release before 2024.0.0

1. Check installed version

apt-cache policy autocad-advance-steel || rpm -q autocad-advance-steel || autocad-advance-steel --version

2. UPGRADE to 2023.1.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade autocad-advance-steel

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade autocad-advance-steel

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2024.0.0 (Debian / Ubuntu)

apt-cache madison autocad-advance-steel sudo apt install autocad-advance-steel=<VERSION_BEFORE_2024.0.0> sudo apt-mark hold autocad-advance-steel

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list autocad-advance-steel sudo dnf downgrade autocad-advance-steel-<VERSION_BEFORE_2024.0.0> sudo dnf versionlock add autocad-advance-steel

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

autodesk autocad architecture UPGRADE

Affected: < 2023.1.4 · >= 2024.0.0 and < 2024.1.1

Fixed in: 2023.1.4, 2024.1.1

Safe to downgrade to: a release before 2024.0.0

1. Check installed version

apt-cache policy autocad-architecture || rpm -q autocad-architecture || autocad-architecture --version

2. UPGRADE to 2023.1.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade autocad-architecture

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade autocad-architecture

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2024.0.0 (Debian / Ubuntu)

apt-cache madison autocad-architecture sudo apt install autocad-architecture=<VERSION_BEFORE_2024.0.0> sudo apt-mark hold autocad-architecture

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list autocad-architecture sudo dnf downgrade autocad-architecture-<VERSION_BEFORE_2024.0.0> sudo dnf versionlock add autocad-architecture

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

autodesk autocad civil 3d UPGRADE

Affected: < 2023.1.4 · >= 2024.0.0 and < 2024.1.1

Fixed in: 2023.1.4, 2024.1.1

Safe to downgrade to: a release before 2024.0.0

1. Check installed version

apt-cache policy autocad-civil-3d || rpm -q autocad-civil-3d || autocad-civil-3d --version

2. UPGRADE to 2023.1.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade autocad-civil-3d

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade autocad-civil-3d

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2024.0.0 (Debian / Ubuntu)

apt-cache madison autocad-civil-3d sudo apt install autocad-civil-3d=<VERSION_BEFORE_2024.0.0> sudo apt-mark hold autocad-civil-3d

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list autocad-civil-3d sudo dnf downgrade autocad-civil-3d-<VERSION_BEFORE_2024.0.0> sudo dnf versionlock add autocad-civil-3d

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

autodesk autocad electrical UPGRADE

Affected: < 2023.1.4 · >= 2024.0.0 and < 2024.1.1

Fixed in: 2023.1.4, 2024.1.1

Safe to downgrade to: a release before 2024.0.0

1. Check installed version

apt-cache policy autocad-electrical || rpm -q autocad-electrical || autocad-electrical --version

2. UPGRADE to 2023.1.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade autocad-electrical

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade autocad-electrical

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2024.0.0 (Debian / Ubuntu)

apt-cache madison autocad-electrical sudo apt install autocad-electrical=<VERSION_BEFORE_2024.0.0> sudo apt-mark hold autocad-electrical

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list autocad-electrical sudo dnf downgrade autocad-electrical-<VERSION_BEFORE_2024.0.0> sudo dnf versionlock add autocad-electrical

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-41139?

autocad: upgrade to 2024.1; autocad: upgrade to 2023.1.4, 2024.1.1; autocad advance steel: upgrade to 2023.1.4, 2024.1.1. Exact commands for each OS are on this page.

Is CVE-2023-41139 being exploited?

CVE-2023-41139 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-41139 affect?

CVE-2023-41139 affects autocad, autocad, autocad advance steel. Severity is high (CVSS 7.8). A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.

How urgent is CVE-2023-41139?

Priority 32/100. High severity

Related CVEs

CVE-2026-7406 HIGH 7.8 UPGRADE UPGRADE A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer D
CVE-2026-7405 MEDIUM 5.5 UPGRADE UPGRADE A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause a
CVE-2025-8893 HIGH 7.8 UPGRADE UPGRADE A maliciously crafted PDF file, when parsed through certain Autodesk products, can force an Out-of-Bounds Writ
CVE-2025-8894 HIGH 7.8 UPGRADE UPGRADE A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Heap-Based Overflow
CVE-2025-5048 HIGH 7.8 DOWNGRADE DOWNGRADE A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force a Memory Corruption v

References

← Back to latest CVEs