Orphaned VBA Projects Inside DWG Files

As cited

Copy frozen at 2026-10-14 11:25 UTC (site build).

research

Orphaned VBA Projects Inside DWG Files

VBA code can be embedded inside AutoCAD drawing files (.dwg) through an OLE container, typically accessed via a pointer in the file header. The author discovered exceptions where this pointer is zero but the embedded VBA project still exists orphaned in the file, unexecutable by AutoCAD even if the file is opened.

Why it matters: Security analysts and malware researchers examining DWG files for embedded macros should verify that discovered VBA projects are not orphaned by checking the pointer at offset 0x24, as orphaned code poses no execution risk but may indicate file manipulation or tool misuse.

Source published

2026-10-14 06:49 UTC

First seen by Cybersecurity Tracker

2026-10-14 10:02 UTC