Years ago I wrote diary entries about VBA code stored inside AutoCAD drawing files (.dwg).

In a nutshell: the VBA code is stored inside an OLE file, that is embedded inside the DWG file. You can do a brute-force search for the embedded OLE file, or you can follow a pointer inside the header of the DWG file.

I wrote a small Python script (autocad.py) for this second case. It looks at a 32-bit pointer at position 0x24 inside the DWG file. This points to a 16-byte long header, followed by the embedded file. This 16-byte long header contains the length of the embedded file. You use the script together with my tool cut-bytes.py, like this:

cut-bytes.py -S autocad.py -P AutoCAD : 461ed52aeb75384133a8238b2eb481ae5d505d4961effa622673d65a889c8218.vir.zip | oledump.py

This command carves the DWG file (inside the ZIP file) and extracts the embedded OLE file, and pipes it into oledump.py for analysis.

When the pointer is zero, there is no embedded OLE file, and cut-bytes.py returns nothing.

Recently, I discovered 2 DWG files that are an exception: their pointer to the embedded OLE file is zero, but if you do a brute-force search, you will find an embedded OLE file with a VBA project.

For example this DWG file.

Its pointer to the embedded VBA project is zero:

But it contains an embedded OLE file:

And right in front of the embedded OLE file, there is the 16-byte long header that contains the lenght of the embedded file.

Using the AutoCAD script to extract the file gives nothing:

But oledump.py can find the embedded OLE file and analyze it:

So while using oledump.py to analyze DWG files you find a VBA project embedded inside a DWG file, then also verify if it is not orphaned: verify that the pointer at 0x24 is not zero (or use the autocad.py script).

Because when a DWG file contains an orphaned VBA project, the VBA code can not have executed when someone opened the DWG file with AutoCAD. AutoCAD "does not see" orphaned VBA projects.

Notice that a default installation of AutoCAD does not support VBA. VBA for AutoCAD is a separate install.

I don't know how orphaning happens, but I did find an AutoLISP command to remove a VBA project from a DWG file: 

(dictremove (namedobjdict) "ACAD_VBA")

Maybe this dictremove command clears the pointer, but does not remove the embedded OLE file.

Didier Stevens
Senior handler
blog.DidierStevens.com

Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and one is already exploited.

CVE-2026-96951: An already exploited Windows Shell Security Feature Bypass Vulnerability. This vulnerabliity allows bypassing the "Mark of the Web" making it easier to exeucte code by sending a malicious message to a user via e-mail or instant messaging. The victim will still have to open the file.

CVE-2026-108398: This vulnerability, a .NET framework security feature bypass, could be used to bypass application control and execute unauthorized applications. Details were available public head of today's release, but Microsoft did not detect exploitation in the wild.

Windows DHCP Server: 10 remote code execution vulenrabilities, including five critical vulnerabilities, affect the Windows DHCP server.

CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability. Microsoft considers the attack complexity high. The vulnerability is triggered by an attacker sending a specific email to the exchange server that triggers the vulnerability during content conversion. 

Aside from these specific vulnerabilities, the larger number of Office vulnerabilities is noteworthy, and the Office updates should likely be addressed quickly.