CVE-2023-27911: AutoDesk: CVE-2023-27911 Heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior

Overview

Severity

High (CVSS 7.8)

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Remote Code Execution

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2023-Jun

Released

2023-06-13

Last Updated

2024-03-12

EPSS Score

0.10% (percentile: 26.6%)

FAQ

Why is this AutoDesk CVE included in the Security Update Guide? The vulnerability assigned to this CVE is in AutoDesk software which is consumed by the Microsoft products listed in the Security Updates table. It is being documented in the Security Update Guide to announce that the latest builds of these products are no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

Affected Products (19)

Developer Tools

• Microsoft Visual Studio 2022 version 17.8
• Microsoft Visual Studio 2022 version 17.9
• Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
• Microsoft Visual Studio 2022 version 17.2
• Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
• Microsoft Visual Studio 2022 version 17.0
• Microsoft Visual Studio 2013 Update 5
• Microsoft Visual Studio 2015 Update 3
• Microsoft Visual Studio 2022 version 17.4
• Microsoft Visual Studio 2022 version 17.6

Microsoft Office

• Microsoft Office 2019 for 32-bit editions
• Microsoft Office 2019 for 64-bit editions
• Microsoft 365 Apps for Enterprise for 32-bit Systems
• Microsoft 365 Apps for Enterprise for 64-bit Systems
• Microsoft Office LTSC 2021 for 64-bit editions
• Microsoft Office LTSC 2021 for 32-bit editions
• Microsoft Visio 2016 (32-bit edition)
• Microsoft Visio 2016 (64-bit edition)

Apps

• 3D Viewer

Security Updates (11)

• Release Notes
• Release Notes
• Release Notes
• Release Notes
• Release Notes
• Release Notes
• Release Notes
• 5026454
• 5026455
• Release Notes
• Release Notes

Acknowledgments

Mat Powell & Michael DePlante (@izobashi) of <a href="https://www.zerodayinitiative.com/">Trend Micro Zero Day Initiative</a>, HAO LI of VenusTech ADLab

Revision History

• 2023-06-13: Information published.
• 2023-09-14: In the Security Updates table, added all supported versions of 3D Viewer, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft 365 Apps for Enterprise because these products are also affected by this vulnerability. Microsoft strongly recommends that customers running any of these products install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.
• 2024-03-12: In the Security Updates table, made the following changes: 1) Added Microsoft Visual Studio 2022 version 17.8 and Microsoft Visual Studio 2022 version 17.9 as these versions are affected by this vulnerability. 2) Microsoft has released security updates on March 12, 2024 to comprehensively address this vulnerability for Microsoft Visual Studio 2022 version 17.4 and Microsoft Visual Studio 2022 version 17.6. Microsoft recommends customers install the updates to be fully protected from the vulnerability.