CVE-2022-42941: 
Autodesk Design Review vulnerability analysis and mitigation

CVE-2022-42941 is a Remote Code Execution vulnerability discovered in Autodesk Design Review that affects the application's handling of Macintosh Pict (PCT) files. The vulnerability was discovered in late May 2022 and publicly disclosed on October 21, 2022. The vulnerability affects Autodesk Design Review version 2018 Hotfix 5 and earlier versions (Fortinet Blog).

The vulnerability occurs during the decoding of Macintosh Pict (PCT) files in Autodesk Design Review. Specifically, when processing a malformed PCT file, an out-of-bounds memory write occurs due to improper bounds checking. This memory corruption vulnerability can be triggered through the DesignReview.exe application when consuming maliciously crafted PCT files (NVD, Fortinet Blog).

If successfully exploited, attackers can execute arbitrary code within the context of the current process through a specially crafted PCT file. This could potentially lead to unauthorized code execution on the affected system (Fortinet Blog).

The vulnerability requires user interaction to exploit, as the target must open a malicious PCT file. The attack vector is local, requiring no privileges, but user interaction is required for successful exploitation (AttackerKB).

Autodesk has released security patches to address this vulnerability. Users of Autodesk Design Review 2018 are advised to install Hotfix 5 or later versions. Fortinet has also released an IPS signature (Autodesk.Design.Review.CVE-2022-42941.Remote.Code.Execution) to protect their customers from potential exploits (Fortinet Blog, Autodesk Advisory).