CVE-2024-1847 is a high severity (CVSS 7.8) group of memory corruption flaws in the file reading code of eDrawings in SOLIDWORKS 2023 through 2024. Opening a specially crafted CAD file could let an attacker run code. Check the Dassault Systemes advisory page and install the update for your release.
What's affected
eDrawings in SOLIDWORKS, from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. The description lists a long set of weaknesses in the file reading procedure: heap based buffer overflow (CWE-122), out of bounds read (CWE-125), use after free (CWE-416), CWE-457 (use of an uninitialized variable), out of bounds write (CWE-787), type confusion (CWE-843) and CWE-908 (use of uninitialized resource).
The file formats named are CATPART, IPT, JT, SAT, STL, STP, X_B and X_T. The description says an attacker could execute arbitrary code while a user opens a specially crafted file in one of these formats.
The record says CVE-2024-3298 and CVE-2024-3299 were split from this ID, so related issues have their own numbers. The record's only reference is the Dassault Systemes vulnerability advisories index, which I could not retrieve here, so I cannot name a fixed service pack. Read the advisory for your release.
The CVSS vector requires user interaction and local access, which fits file based attacks.
How to check if you're exposed
eDrawings ships with SOLIDWORKS and is also installed alone as a free viewer, so check both.
On Windows, list installed versions:
Get-Package | Where-Object { $_.Name -match "eDrawings|SOLIDWORKS" } | Select-Object Name, Version
Or open eDrawings and choose Help, About eDrawings to see the release. Releases from 2023 through 2024 are in the described range.
Think about where CAD files come from. Files received from suppliers, customers and public model libraries are the usual way a crafted file reaches a user. Engineering teams that exchange files with outside parties should be treated as the first priority.
What to do now
- Inventory SOLIDWORKS and eDrawings installs, including viewer only machines.
- Open the Dassault Systemes advisories page, find the entry for CVE-2024-1847, and install the service pack or update it names for your release.
- Until patched, open CAD files only from sources you trust, and avoid opening unknown STEP, JT, STL or SAT files.
- Keep endpoint protection active on engineering workstations, which often hold valuable design data.
- Add eDrawings to your patch tracking so viewer only installs do not get missed.
Why it matters
Memory corruption bugs arise when a parser reads a complex file format and mishandles its own memory. A malformed file can make the program read or write outside the space it set aside, use memory after it was freed, or treat data as the wrong type. Attackers who control the file can sometimes steer these errors into running their own code.
File viewers are a common target because users open files from outside the company all the time. The attack needs no network exposure, just a user who opens a file. That is why the vector shows local access with user interaction, and why the score of 7.8 is high but not critical.
The data on a CAD workstation, such as unreleased product designs, makes a compromise valuable. The record's Known Exploited Vulnerabilities flag is false.
Quick check
Which file types are affected?
CATPART, IPT, JT, SAT, STL, STP, X_B and X_T, according to the description.
Where do I find the fixed version?
The record points to the Dassault Systemes vulnerability advisories page. Check it for your release, because I could not retrieve the page to confirm a version.
Sources
- NVD record for CVE-2024-1847
- Dassault Systemes advisories index listed in the record (not retrievable when reviewed)
Last reviewed: 19 October 2026.
