How severe is CVE-2024-7995?

CVE-2024-7995 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-7995 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-7995?

CVE-2024-7995 affects Autodesk Vred. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-7995?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-7995 have an EU (EUVD) identifier?

Yes. CVE-2024-7995 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-48825.

When was CVE-2024-7995 published?

CVE-2024-7995 was published on 2024-11-05 and last updated on 2026-06-17.

CVE-2024-7995

CVE-2024-7995 is a high-severity vulnerability in Autodesk Vred with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-426.

Key facts

Severity: High (CVSS 3.x base score 7.8)
EPSS exploit prediction: 0% (10th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-48825
Weakness: CWE-426
Affected product: Autodesk Vred
Published: 2024-11-05
Last modified: 2026-06-17

Description

A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the VRED Design application. Exploitation of this vulnerability may lead to code execution.

Frequently asked questions

What is CVE-2024-7995?: A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the VRED Design application. Exploitation of this vulnerability may lead to code execution.
How severe is CVE-2024-7995?: CVE-2024-7995 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-7995 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-7995?: CVE-2024-7995 affects Autodesk Vred. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-7995?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-7995 have an EU (EUVD) identifier?: Yes. CVE-2024-7995 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-48825.
When was CVE-2024-7995 published?: CVE-2024-7995 was published on 2024-11-05 and last updated on 2026-06-17.

References

https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0022

Affected products (1)

cpe:2.3:a:autodesk:vred:*:*:*:*:design:*:*:*

More vulnerabilities in Autodesk Vred

CVE-2014-2967 — Critical (CVSS 10.0): Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute arbitrary code via Python os library…
CVE-2023-25002 — High (CVSS 7.8): A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of…
CVE-2023-29068 — High (CVSS 7.8): A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities. These…
CVE-2023-25004 — High (CVSS 7.8): A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities.…
CVE-2023-25003 — High (CVSS 7.8): A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read…

All CVEs affecting Autodesk Vred →

Other CWE-426 (Untrusted Search Path) vulnerabilities

CVE-2026-45772 — Critical (CVSS 9.8): Turborepo is a high-performance build system for JavaScript and TypeScript codebases. From 1.1.0 to before 2.9.14,…
CVE-2025-26155 — Critical (CVSS 9.8): NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path…
CVE-2024-53866 — Critical (CVSS 9.8): The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one…
CVE-2024-38462 — Critical (CVSS 9.8): iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the…
CVE-2023-30330 — Critical (CVSS 9.8): SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function…
CVE-2022-24826 — Critical (CVSS 9.8): On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and…

Browse all CWE-426 (Untrusted Search Path) vulnerabilities →