CVE-2024-9500
CVE-2024-9500 is a high-severity vulnerability in Autodesk Installer with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-379.
Key facts
- Severity: High (CVSS 3.x base score 7.8)
- EPSS exploit prediction: 0% (9th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-50370
- Weakness: CWE-379
- Affected product: Autodesk Installer
- Published:
- Last modified:
Description
A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to insecure privilege management.
Frequently asked questions
- What is CVE-2024-9500?
- A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to insecure privilege management.
- How severe is CVE-2024-9500?
- CVE-2024-9500 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2024-9500 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-9500?
- CVE-2024-9500 affects Autodesk Installer. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-9500?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2024-9500 have an EU (EUVD) identifier?
- Yes. CVE-2024-9500 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-50370.
- When was CVE-2024-9500 published?
- CVE-2024-9500 was published on 2024-11-15 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:autodesk:installer:*:*:*:*:*:*:*:*
More vulnerabilities in Autodesk Installer
- CVE-2025-10885 — High (CVSS 7.8): A maliciously crafted file, when executed on the victim's machine, can lead to privilege escalation to NT…
- CVE-2025-5335 — High (CVSS 7.8): A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to…
- CVE-2023-27908 — High (CVSS 7.8): A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when…
All CVEs affecting Autodesk Installer →
Other CWE-379 vulnerabilities
- CVE-2024-9950 — High (CVSS 7.8): A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify…
- CVE-2023-6080 — High (CVSS 7.8): Lakeside Software’s SysTrack LsiAgent Installer version 10.7.8 for Windows contains a local privilege escalation…
- CVE-2023-3181 — High (CVSS 7.8): The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at…
- CVE-2023-37243 — High (CVSS 7.8): The C:\Windows\Temp\Agent.Package.Availability\Agent.Package.Availability.exe file is automatically launched as SYSTEM…
- CVE-2023-26396 — High (CVSS 7.8): Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Creation of…
- CVE-2023-21612 — High (CVSS 7.8): Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are…