CVE-2022-42944: 
Autodesk Design Review vulnerability analysis and mitigation

CVE-2022-42944 is a memory corruption vulnerability discovered in Autodesk Design Review that was disclosed on October 21, 2022. The vulnerability specifically affects the DesignReview.exe application when processing maliciously crafted DWF or PCT files, leading to an out-of-bounds read memory access due to improper bounds checking (NVD, FortiGuard Labs).

The vulnerability is characterized by an out-of-bounds read vulnerability that exists in the decoding of Macintosh Pict (PCT) files in Autodesk Design Review. When processing a malformed PCT file, the application can be forced to perform an out-of-bounds read memory access due to improper bounds checking. This vulnerability requires user interaction to exploit, as the target must open a malicious file (FortiGuard Labs).

If exploited, this vulnerability could allow a remote attacker to leak sensitive information within the context of the application through a specially crafted PCT file. The vulnerability becomes more significant when combined with other vulnerabilities, potentially leading to code execution in the context of the current process (FortiGuard Labs).

The vulnerability requires user interaction for exploitation, as the target must open a maliciously crafted file. The attack vector is local, requiring no privileges, but user interaction is necessary for successful exploitation (AttackerKB).

Autodesk has released a security hotfix (version 2018 Hotfix 5) to address this vulnerability. Users of Autodesk Design Review 2018 and earlier versions are strongly recommended to download and install the security hotfix via the Autodesk Knowledge Network (Autodesk Advisory). Additionally, Fortinet has released an IPS signature named Autodesk.Design.Review.CVE-2022-42944.Memory.Corruption to protect their customers (FortiGuard Labs).