Orphaned VBA Projects Inside DWG Files, (Wed, Oct 14th)

AutoCAD DWG files can contain embedded VBA code stored inside OLE files. Typically, a pointer at offset 0x24 in the DWG file header indicates the location of the embedded VBA project. However, some DWG files have orphaned VBA projects where this pointer is zero, yet the embedded OLE file with VBA code remains present. These orphaned VBA projects are not executed by AutoCAD because the pointer is missing or cleared, possibly due to commands like (dictremove (namedobjdict) "ACAD_VBA"). Detection requires brute-force searching for embedded OLE files rather than relying solely on the pointer. The report provides Python scripts and tools to extract and analyze these embedded VBA projects.

Orphaned VBA projects inside DWG files do not execute when the file is opened in AutoCAD because the pointer to the VBA project is zero. Therefore, these orphaned VBA projects do not pose an immediate execution risk within AutoCAD. However, their presence may indicate leftover or incomplete removal of VBA code, which could be relevant for forensic analysis or malware investigations. There is no indication of active exploitation or direct security impact from these orphaned projects.

No direct remediation is required as orphaned VBA projects are not executed by AutoCAD. Users should verify the pointer at offset 0x24 to confirm if embedded VBA projects are orphaned. If removal of VBA projects is desired, commands like (dictremove (namedobjdict) "ACAD_VBA") may clear the pointer but may not remove the embedded OLE file. Further manual cleanup may be necessary if complete removal is required. Since AutoCAD does not execute orphaned VBA projects, no urgent action is needed.