CVE-2021-40162

HIGH 7.8CVE-2021-40162 · Published 07/10/2022 · updated 17/06/2026

In short

CVE-2021-40162 is a HIGH (CVSS 7.8) vulnerability affecting autocad (autodesk), autocad advance steel (autodesk), autocad architecture (autodesk).
Chance of exploitation in the next 30 days (EPSS): 0.97%, higher than 62.0% of all vulnerabilities.
Fix: update to 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2 or later.

Package	Affected versions	Patched versions
autocad autodesk	`≥ 2019, < 2019.1.4≥ 2020, < 2020.1.5≥ 2021, < 2021.1.2≥ 2022, < 2022.1.2`	`2019.1.42020.1.52021.1.22022.1.2`
autocad advance steel autodesk	`≥ 2019, < 2019.1.4≥ 2020, < 2020.1.5≥ 2021, < 2021.1.2≥ 2022, < 2022.1.2`	`2019.1.42020.1.52021.1.22022.1.2`
autocad architecture autodesk	`≥ 2019, < 2019.1.4≥ 2020, < 2020.1.5≥ 2021, < 2021.1.2≥ 2022, < 2022.1.2`	`2019.1.42020.1.52021.1.22022.1.2`
autocad civil 3d autodesk	`≥ 2019, < 2019.1.4≥ 2020, < 2020.1.5≥ 2021, < 2021.1.2≥ 2022, < 2022.1.2`	`2019.1.42020.1.52021.1.22022.1.2`
autocad electrical autodesk	`≥ 2019, < 2019.1.4≥ 2020, < 2020.1.5≥ 2021, < 2021.1.2≥ 2022, < 2022.1.2`	`2019.1.42020.1.52021.1.22022.1.2`
autocad lt autodesk	`≥ 2019, < 2019.1.4≥ 2020, < 2020.1.5≥ 2020, < 2020.3.2≥ 2021, < 2021.1.2≥ 2021, < 2021.2.2≥ 2022, < 2022.1.2≥ 2022, < 2022.2.2`	`2019.1.42020.1.52020.3.22021.1.22021.2.22022.1.22022.2.2`
autocad map 3d autodesk	`≥ 2019, < 2019.1.4≥ 2020, < 2020.1.5≥ 2021, < 2021.1.2≥ 2022, < 2022.1.2`	`2019.1.42020.1.52021.1.22022.1.2`
autocad mechanical autodesk	`≥ 2019, < 2019.1.4≥ 2020, < 2020.1.5≥ 2021, < 2021.1.2≥ 2022, < 2022.1.2`	`2019.1.42020.1.52021.1.22022.1.2`
autocad mep autodesk	`≥ 2019, < 2019.1.4≥ 2020, < 2020.1.5≥ 2021, < 2021.1.2≥ 2022, < 2022.1.2`	`2019.1.42020.1.52021.1.22022.1.2`
autocad plant 3d autodesk	`≥ 2019, < 2019.1.4≥ 2020, < 2020.1.5≥ 2021, < 2021.1.2≥ 2022, < 2022.1.2`	`2019.1.42020.1.52021.1.22022.1.2`
design review autodesk	`= 2018`	No fix yet
dwg trueview autodesk	`≥ 2019, < 2019.1.4≥ 2020, < 2020.1.5≥ 2021, < 2021.1.2≥ 2022, < 2022.1.1`	`2019.1.42020.1.52021.1.22022.1.1`
fusion autodesk	`≥ 2.0.10356, < 2.0.11405`	`2.0.11405`
infrastructure parts editor autodesk	`= 2021= 2022≥ 2019, < 2019.2.2≥ 2020, < 2020.0.2`	`2019.2.22020.0.2`
infraworks autodesk	`= 2019.3= 2020.2= 2021.2= 2022.0= 2022.1≥ 2019, < 2019.3≥ 2020, < 2020.2≥ 2021, < 2021.2`	`2019.32020.22021.2`
inventor autodesk	`≥ 2019, < 2019.6≥ 2020, < 2020.5≥ 2021, < 2021.4≥ 2022, < 2022.2`	`2019.62020.52021.42022.2`
navisworks autodesk	`≥ 2019, < 2019.7≥ 2020, < 2020.5≥ 2021, < 2021.4≥ 2022, < 2022.2`	`2019.72020.52021.42022.2`
revit autodesk	`= 2022≥ 2019, < 2019.2.4≥ 2020, < 2020.2.6≥ 2021, < 2021.1.5`	`2019.2.42020.2.62021.1.5`
storm and sanitary analysis autodesk	`= 2019= 2022≥ 2020, < 2020.3.1≥ 2021, < 2021.3.1`	`2020.3.12021.3.1`

Description

A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code.

References

autodesk.com/trust/security-advisories/adsk-sa-2021-0011 · Vendor Advisory

More vulnerabilities in autocad

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2021-40162 is a HIGH (CVSS 7.8) vulnerability affecting autocad (autodesk), autocad advance steel (autodesk), autocad architecture (autodesk).

Chance of exploitation in the next 30 days (EPSS): 0.97%, higher than 62.0% of all vulnerabilities.

Fix: update to 2019.1.4, 2020.1.5, 2021.1.2, 2022.1.2 or later.

Package

Affected versions

Patched versions