Autodesk Navisworks Freedom 2025 DWFX File buffer overflow

Summaryinfo

A vulnerability identified as critical has been detected in Autodesk Navisworks Freedom, Navisworks Simulate and Navisworks Manage 2025. This impacts an unknown function of the component DWFX File Handler. Performing a manipulation results in buffer overflow. This vulnerability is cataloged as CVE-2024-12194. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Autodesk Navisworks Freedom, Navisworks Simulate and Navisworks Manage 2025. This affects some unknown functionality of the component DWFX File Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

It is possible to read the advisory at autodesk.com. This vulnerability is uniquely identified as CVE-2024-12194 since 12/04/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 213280 (Autodesk Navisworks Freedom 25.0.x < 2025.4 Multiple Vulnerabilities (adsk-sa-2024-0027)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (213280). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Autodesk

Name

• Navisworks Freedom
• Navisworks Manage
• Navisworks Simulate

Version

• 2025

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion