Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2023-41139
Autodesk AutoCAD, Advance Steel and Civil 3D — A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer.
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U H H H 7.8 .0027 18.6 —
AFFECTED
Product Versions Fixed
AutoCAD, Advance Steel and Civil 3D 2024, 2023 – —
TIMELINE
Aug 23 Reserved by autodesk
Nov 23 Published (CNA: autodesk)
Oct 8 ENRICHED — CVE-2023-41139 (Autodesk AutoCAD, Advance Steel and Civil 3D). Received CVSS 7.8 and CPE data from NVD.
Description
A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| August 23, 2023 | Reserved | Reserved by autodesk |
| November 23, 2023 | Published | Published (CNA: autodesk) |
| October 8, 2026 | ENRICHED | ENRICHED — CVE-2023-41139 (Autodesk AutoCAD, Advance Steel and Civil 3D). Received CVSS 7.8 and CPE data from NVD. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Autodesk | AutoCAD, Advance Steel and Civil 3D | — | 2024, 2023 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-41139 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
