Zero-Day Advisory
Fortinet Discovers Autodesk Design Review Memory Corruption Vulnerability
Summary
Fortinet's FortiGuard Labs has discovered a Memory Corruption vulnerability in Autodesk Design Review.
Autodesk Design Review is a CAD viewer software by AutoDesk that lets you view, mark up, print, and track changes to 2D and 3D files for free without the original design software.
A memory corruption vulnerability has been discovered in AutoDesk Design Review by FortiGuard Labs. The vulnerability is caused by a crafted DWF file which causes an out-of-bounds memory access. It could allow malicious users to create sensitive information leak scenarios.
Solutions
FortiGuard Labs released the following FortiGate IPS signature which covers this specific vulnerability:Autodesk.Design.Review.CVE-2021-40167.Memory.Corruption
Released Apr 06, 2022
Users should apply the solution provided by Autodesk.
Timeline
Fortinet reported the vulnerability to Autodesk on November 08, 2021.
AutoDesk confirmed the vulnerability on November 10, 2021.
AutoDesk patched the vulnerability on March 28, 2022.