CVE-2020-7081: 
Autodesk FBX SDK vulnerability analysis and mitigation

A type confusion vulnerability (CVE-2020-7081) was discovered in the Autodesk FBX Software Development Kit (SDK) versions 2019.0 and earlier. The vulnerability was disclosed on April 15, 2020, affecting various Microsoft applications including Office 365 ProPlus, Microsoft Office 2019, and Paint 3D, as well as multiple Autodesk products that utilize the FBX library (Autodesk Advisory, NVD).

The vulnerability is rated as HIGH severity with a CVSS v3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The type confusion vulnerability in FBX's SDK could allow an attacker to read/write out-of-bounds memory location or run arbitrary code on the system, potentially leading to denial-of-service conditions. To exploit the vulnerability, an attacker would need to send a specially crafted file containing 3D content to a user and convince them to open it (SecurityWeek, CERT-EU).

If successfully exploited, the vulnerability could allow an attacker to gain the same user rights as the local user. Users with administrative privileges would be more severely impacted than those with restricted user rights. The vulnerability could lead to arbitrary code execution or denial-of-service conditions on the affected system (Threatpost).

The vulnerability requires user interaction for successful exploitation. An attacker must craft a malicious file containing 3D content and convince the target user to open it. The attack vector is network-based with low attack complexity, requiring no privileges but necessitating user interaction (NVD).

Microsoft addressed the vulnerability by correcting the way 3D content is handled by their software. Users are recommended to apply the security updates via Microsoft Update. For third-party developers using the FBX-SDK in their applications or services, it is recommended to obtain and apply the latest version of the FBX-SDK from the official update source (CERT-EU).

Security researcher Max Van Amerongen demonstrated a proof-of-concept exploit related to the FBX vulnerabilities on Twitter. The security community noted that this vulnerability highlighted how incorporating third-party tools and code means also incorporating their vulnerabilities into products (Threatpost).