CVE-2024-23139

A maliciously crafted ABC file, when parsed through Autodesk FBX, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0005	Vendor Advisory
https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0005	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:autodesk:fbx_review:1.5.3:*:*:*:*:*:*:*

History

16 Apr 2025, 18:13

Type	Values Removed	Values Added
First Time		Autodesk Autodesk fbx Review
References	~~() https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0005 -~~	() https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0005 - Vendor Advisory
CPE		cpe:2.3:a:autodesk:fbx_review:1.5.3:::::::*

10 Feb 2025, 21:15

Type	Values Removed	Values Added
Summary	(en) An Out-Of-Bounds Write Vulnerability in Autodesk FBX Review version 1.5.3.0 and prior may lead to code execution or information disclosure through maliciously crafted ActionScript Byte Code “ABC” files. ABC files are created by the Flash compiler and contain executable code. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.	(en) A maliciously crafted ABC file, when parsed through Autodesk FBX, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

28 Jan 2025, 20:15

Type	Values Removed	Values Added
Summary	(en) An Out-Of-Bounds Write Vulnerability in Autodesk FBX Review version 1.5.3.0 and prior may lead to code execution or information disclosure through maliciously crafted ActionScript Byte Code “ABC” files. ABC files are created by the Flash compiler and contain executable code. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.	(en) An Out-Of-Bounds Write Vulnerability in Autodesk FBX Review version 1.5.3.0 and prior may lead to code execution or information disclosure through maliciously crafted ActionScript Byte Code “ABC” files. ABC files are created by the Flash compiler and contain executable code. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.

21 Nov 2024, 08:57

Type	Values Removed	Values Added
References	~~() https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0005 -~~	() https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0005 -

27 Aug 2024, 14:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8

18 Mar 2024, 01:13

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-18 00:15

Updated : 2025-04-16 18:13

NVD link : CVE-2024-23139

Mitre link : CVE-2024-23139

CVE.ORG link : CVE-2024-23139

JSON object : View

Products Affected

autodesk

fbx_review

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2024-23139", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@autodesk.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-03-18T00:15:07.663", "references": [{"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0005", "tags": ["Vendor Advisory"], "source": "psirt@autodesk.com"}, {"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0005", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@autodesk.com", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted ABC file, when parsed through Autodesk FBX, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."}, {"lang": "es", "value": "Una vulnerabilidad de escritura fuera de los l\u00edmites en Autodesk FBX Review versi\u00f3n 1.5.3.0 y anteriores puede provocar la ejecuci\u00f3n de c\u00f3digo o la divulgaci\u00f3n de informaci\u00f3n a trav\u00e9s de archivos de c\u00f3digo de bytes \u201cABC\u201d de ActionScript creados con fines malintencionados. Los archivos ABC son creados por el compilador Flash y contienen c\u00f3digo ejecutable. Esta vulnerabilidad, junto con otras vulnerabilidades, podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo en el contexto del proceso actual."}], "lastModified": "2025-04-16T18:13:06.423", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:fbx_review:1.5.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9F728E1-4904-4153-91F7-B88E331FE13A"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@autodesk.com"}

7.8 /10