High severity7.8NVD Advisory· Published Oct 3, 2022· Updated Jun 17, 2026

CVE-2022-33886

Description

A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023, 2022, 2021, 2020, and Maya 2023 and 2022. The vulnerability exists because the application fails to handle crafted MODEL and SLDPRT files, which causes an unhandled exception. A malicious actor could leverage this vulnerability to execute arbitrary code.

Affected products

Autodesk/Autocad4 versions
cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*range: >=2022,<2022.1.3
- cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*range: >=2022,<2022.1.3
- (no CPE)
- (no CPE)range: 2023, 2022, 2021, 2020
Autodesk/Autocad Advance Steel
cpe:2.3:a:autodesk:autocad_advance_steel:*:*:*:*:*:*:*:*
Range: >=2022,<2022.1.3
Autodesk/Autocad Architecture
cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*
Range: >=2022,<2022.1.3
Autodesk/Autocad Civil 3d
cpe:2.3:a:autodesk:autocad_civil_3d:*:*:*:*:*:*:*:*
Range: >=2022,<2022.1.3
Autodesk/Autocad Electrical
cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*
Range: >=2022,<2022.1.3
Autodesk/Autocad Map 3d
cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*
Range: >=2022,<2022.1.3
Autodesk/Autocad Mechanical
cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*
Range: >=2022,<2022.1.3
Autodesk/Autocad Mep
cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*
Range: >=2022,<2022.1.3
Autodesk/Autocad Plant 3d
cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*
Range: >=2022,<2022.1.3
Autodesk/Mayallm-fuzzy
Range: 2023, 2022

cvss	0.507
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2022-33886

Description

Affected products

Patches

Vulnerability mechanics

References

News mentions