Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
755 vulnerabilities by autodesk
CVE-2026-8325 (GCVE-0-2026-8325)
Vulnerability from nvd – Published: 2026-08-06 15:58 – Updated: 2026-08-08 03:55
VLAI
EPSS
VEX
Title
PDF File Parsing Out-of-Bounds Write Vulnerability in Autodesk Revit
Summary
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-Bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8325",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T03:55:30.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.2.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.5.0",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-Bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:58:02.242Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0011"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "PDF File Parsing Out-of-Bounds Write Vulnerability in Autodesk Revit",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-8325",
"datePublished": "2026-08-06T15:58:02.242Z",
"dateReserved": "2026-05-11T14:02:24.198Z",
"dateUpdated": "2026-08-08T03:55:30.658Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7406 (GCVE-0-2026-7406)
Vulnerability from nvd – Published: 2026-08-06 16:31 – Updated: 2026-08-07 18:30
VLAI
EPSS
VEX
Title
BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products
Summary
A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-822 - Untrusted Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Revit |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.5.0 (semver) Affected: 2024.0.0 , < 2024.3.5 (semver) cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD LT |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:* |
|
| Autodesk | DWG TrueView |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7406",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T15:32:33.647250Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T15:35:08.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.5.0",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
},
{
"lessThan": "2024.3.5",
"status": "affected",
"version": "2024.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD LT",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "DWG TrueView",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-822",
"description": "CWE-822 Untrusted Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:30:23.049Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-7406",
"datePublished": "2026-08-06T16:31:12.298Z",
"dateReserved": "2026-04-29T13:03:51.562Z",
"dateUpdated": "2026-08-07T18:30:23.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7405 (GCVE-0-2026-7405)
Vulnerability from nvd – Published: 2026-08-06 16:17 – Updated: 2026-08-07 18:30
VLAI
EPSS
VEX
Title
TIF File Parsing Out-of-Bounds Read in certain Autodesk products
Summary
A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-Bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Revit |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.5.0 (semver) Affected: 2024.0.0 , < 2024.3.5 (semver) cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD LT |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:* |
|
| Autodesk | DWG TrueView |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7405",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:22:24.248444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:22:51.825Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.5.0",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
},
{
"lessThan": "2024.3.5",
"status": "affected",
"version": "2024.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD LT",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "DWG TrueView",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service"
}
],
"value": "A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service"
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:30:02.441Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "TIF File Parsing Out-of-Bounds Read in certain Autodesk products",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-7405",
"datePublished": "2026-08-06T16:17:54.589Z",
"dateReserved": "2026-04-29T13:03:48.953Z",
"dateUpdated": "2026-08-07T18:30:02.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1289 (GCVE-0-2026-1289)
Vulnerability from nvd – Published: 2026-08-06 15:57 – Updated: 2026-08-08 03:55
VLAI
EPSS
VEX
Title
PDF File Parsing Use-After-Free Vulnerability in Autodesk Revit
Summary
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T03:55:31.741Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.2.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.5.0",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153: Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:57:13.827Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0011"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "PDF File Parsing Use-After-Free Vulnerability in Autodesk Revit",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-1289",
"datePublished": "2026-08-06T15:57:13.827Z",
"dateReserved": "2026-01-21T14:43:33.946Z",
"dateUpdated": "2026-08-08T03:55:31.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11803 (GCVE-0-2026-11803)
Vulnerability from nvd – Published: 2026-08-06 15:58 – Updated: 2026-08-08 03:55
VLAI
EPSS
VEX
Title
PDF File Parsing Out-of-Bounds Read Vulnerability in Autodesk Revit
Summary
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-Bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T03:55:29.449Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.2.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.5.0",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:58:36.195Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0011"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "PDF File Parsing Out-of-Bounds Read Vulnerability in Autodesk Revit",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-11803",
"datePublished": "2026-08-06T15:58:36.195Z",
"dateReserved": "2026-06-09T15:00:58.771Z",
"dateUpdated": "2026-08-08T03:55:29.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10710 (GCVE-0-2026-10710)
Vulnerability from nvd – Published: 2026-08-04 12:59 – Updated: 2026-08-05 03:56
VLAI
EPSS
VEX
Title
FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK
Summary
A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10710",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T03:56:13.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:fbx_sdk:2020.3.9:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FBX SDK",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2020.3.10",
"status": "affected",
"version": "2020.3.9",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T12:59:51.310Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0010"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-10710",
"datePublished": "2026-08-04T12:59:51.310Z",
"dateReserved": "2026-06-02T18:11:05.634Z",
"dateUpdated": "2026-08-05T03:56:13.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10709 (GCVE-0-2026-10709)
Vulnerability from nvd – Published: 2026-08-04 12:59 – Updated: 2026-08-05 03:56
VLAI
EPSS
VEX
Title
FBX BinaryReadSectionHeader Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK
Summary
A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10709",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T03:56:14.471Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:fbx_sdk:2020.3.9:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FBX SDK",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2020.3.10",
"status": "affected",
"version": "2020.3.9",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T12:59:07.257Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0010"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "FBX BinaryReadSectionHeader Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-10709",
"datePublished": "2026-08-04T12:59:07.257Z",
"dateReserved": "2026-06-02T18:11:04.411Z",
"dateUpdated": "2026-08-05T03:56:14.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17550 (GCVE-0-2026-17550)
Vulnerability from nvd – Published: 2026-07-29 15:23 – Updated: 2026-08-07 18:29
VLAI
EPSS
VEX
Title
DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD
Summary
A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/products/dwg-trueview/overview | patch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | AutoCAD |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD LT |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:* |
|
| Autodesk | DWG TrueView |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T17:57:10.529676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T17:57:17.958Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD LT",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "DWG TrueView",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information."
}
],
"value": "A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:29:35.690Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0009"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/dwg-trueview/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-17550",
"datePublished": "2026-07-29T15:23:16.031Z",
"dateReserved": "2026-07-27T12:14:33.962Z",
"dateUpdated": "2026-08-07T18:29:35.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16465 (GCVE-0-2026-16465)
Vulnerability from nvd – Published: 2026-07-29 15:22 – Updated: 2026-08-07 18:29
VLAI
EPSS
VEX
Title
DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD
Summary
A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/products/dwg-trueview/overview | patch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | AutoCAD |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD LT |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:* |
|
| Autodesk | DWG TrueView |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16465",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T15:55:09.293999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T15:55:18.403Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD LT",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "DWG TrueView",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information."
}
],
"value": "A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:29:17.003Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0009"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/dwg-trueview/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-16465",
"datePublished": "2026-07-29T15:22:42.203Z",
"dateReserved": "2026-07-21T13:11:00.568Z",
"dateUpdated": "2026-08-07T18:29:17.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16463 (GCVE-0-2026-16463)
Vulnerability from nvd – Published: 2026-07-29 15:22 – Updated: 2026-08-07 18:28
VLAI
EPSS
VEX
Title
DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD
Summary
A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/products/dwg-trueview/overview | patch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | AutoCAD |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD LT |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:* |
|
| Autodesk | DWG TrueView |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16463",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T03:55:24.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD LT",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "DWG TrueView",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:28:40.494Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0009"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/dwg-trueview/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-16463",
"datePublished": "2026-07-29T15:22:16.305Z",
"dateReserved": "2026-07-21T13:10:56.170Z",
"dateUpdated": "2026-08-07T18:28:40.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10789 (GCVE-0-2026-10789)
Vulnerability from nvd – Published: 2026-06-22 17:15 – Updated: 2026-06-23 03:56
VLAI
EPSS
VEX
Title
MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop
Summary
A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://dl.appstreaming.autodesk.com/production/i… | patch |
| https://dl.appstreaming.autodesk.com/production/i… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10789",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T03:56:02.324Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:fusion:2703.1.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Fusion",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2703.1.20",
"status": "affected",
"version": "2703.1.11",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user."
}
],
"value": "A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T17:15:25.546Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008"
},
{
"tags": [
"patch"
],
"url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe"
},
{
"tags": [
"patch"
],
"url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-10789",
"datePublished": "2026-06-22T17:15:25.546Z",
"dateReserved": "2026-06-03T19:23:28.312Z",
"dateUpdated": "2026-06-23T03:56:02.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1288 (GCVE-0-2026-1288)
Vulnerability from nvd – Published: 2026-06-17 15:27 – Updated: 2026-06-17 17:30
VLAI
EPSS
VEX
Title
RFA File Parsing Vulnerability in Autodesk Revit
Summary
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Revit |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.4.1 (semver) Affected: 2025.0.0 , < 2025.4.5 (semver) Affected: 2024.0.0 , < 2024.3.5 (semver) cpe:2.3:a:autodesk:revit:2027.1:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2026.4.1:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2025.4.5:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2024.3.5:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T17:30:34.311655Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T17:30:51.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027.1:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2025.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2024.3.5:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.4.1",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
},
{
"lessThan": "2025.4.5",
"status": "affected",
"version": "2025.0.0",
"versionType": "semver"
},
{
"lessThan": "2024.3.5",
"status": "affected",
"version": "2024.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted RFA file, when converted to FormIt via \u201cConvert RFA to FormIt\u201d in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition."
}
],
"value": "A maliciously crafted RFA file, when converted to FormIt via \u201cConvert RFA to FormIt\u201d in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153: Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T15:27:54.195Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0007"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "RFA File Parsing Vulnerability in Autodesk Revit",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-1288",
"datePublished": "2026-06-17T15:27:54.195Z",
"dateReserved": "2026-01-21T14:43:31.726Z",
"dateUpdated": "2026-06-17T17:30:51.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7454 (GCVE-0-2026-7454)
Vulnerability from nvd – Published: 2026-05-26 17:09 – Updated: 2026-05-27 03:55
VLAI
EPSS
VEX
Title
WRL File Parsing Memory Corruption in Autodesk 3ds Max
Summary
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7454",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T03:55:55.888Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:3ds_max:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:3ds_max:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3ds Max",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1",
"status": "affected",
"version": "2027",
"versionType": "custom"
},
{
"lessThan": "2026.1",
"status": "affected",
"version": "2026",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T17:09:08.952Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WRL File Parsing Memory Corruption in Autodesk 3ds Max",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-7454",
"datePublished": "2026-05-26T17:09:08.952Z",
"dateReserved": "2026-04-29T17:19:13.538Z",
"dateUpdated": "2026-05-27T03:55:55.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7453 (GCVE-0-2026-7453)
Vulnerability from nvd – Published: 2026-05-26 17:08 – Updated: 2026-06-03 13:39
VLAI
EPSS
VEX
Title
WRL File Parsing Memory Exhaustion in Autodesk 3ds Max
Summary
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7453",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T18:23:29.878255Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T18:39:06.073Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:3ds_max:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:3ds_max:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3ds Max",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1",
"status": "affected",
"version": "2027",
"versionType": "custom"
},
{
"lessThan": "2026.1",
"status": "affected",
"version": "2026",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition."
}
],
"value": "A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130: Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T13:39:18.808Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WRL File Parsing Memory Exhaustion in Autodesk 3ds Max",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-7453",
"datePublished": "2026-05-26T17:08:40.918Z",
"dateReserved": "2026-04-29T17:19:12.725Z",
"dateUpdated": "2026-06-03T13:39:18.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7452 (GCVE-0-2026-7452)
Vulnerability from nvd – Published: 2026-05-26 17:06 – Updated: 2026-05-27 03:55
VLAI
EPSS
VEX
Title
WRL File Parsing Memory Corruption in Autodesk 3ds Max
Summary
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T03:55:52.364Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:3ds_max:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:3ds_max:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3ds Max",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1",
"status": "affected",
"version": "2027",
"versionType": "custom"
},
{
"lessThan": "2026.1",
"status": "affected",
"version": "2026",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T17:06:35.440Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WRL File Parsing Memory Corruption in Autodesk 3ds Max",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-7452",
"datePublished": "2026-05-26T17:06:35.440Z",
"dateReserved": "2026-04-29T17:19:12.024Z",
"dateUpdated": "2026-05-27T03:55:52.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7451 (GCVE-0-2026-7451)
Vulnerability from nvd – Published: 2026-05-26 17:05 – Updated: 2026-05-27 03:55
VLAI
EPSS
VEX
Title
TIF File Parsing Out-of-Bounds Write in Autodesk 3ds Max
Summary
A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T03:55:53.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:3ds_max:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:3ds_max:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3ds Max",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1",
"status": "affected",
"version": "2027",
"versionType": "custom"
},
{
"lessThan": "2026.1",
"status": "affected",
"version": "2026",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T17:05:56.482Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "TIF File Parsing Out-of-Bounds Write in Autodesk 3ds Max",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-7451",
"datePublished": "2026-05-26T17:05:56.482Z",
"dateReserved": "2026-04-29T17:19:11.566Z",
"dateUpdated": "2026-05-27T03:55:53.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7450 (GCVE-0-2026-7450)
Vulnerability from nvd – Published: 2026-05-26 17:05 – Updated: 2026-06-03 13:38
VLAI
EPSS
VEX
Title
PAR File Parsing NULL Pointer Dereference in Autodesk 3ds Max
Summary
A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T18:26:22.907016Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T18:40:02.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:3ds_max:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:3ds_max:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3ds Max",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1",
"status": "affected",
"version": "2027",
"versionType": "custom"
},
{
"lessThan": "2026.1",
"status": "affected",
"version": "2026",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition."
}
],
"value": "A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T13:38:45.481Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "PAR File Parsing NULL Pointer Dereference in Autodesk 3ds Max",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-7450",
"datePublished": "2026-05-26T17:05:25.646Z",
"dateReserved": "2026-04-29T17:19:10.754Z",
"dateUpdated": "2026-06-03T13:38:45.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7406 (GCVE-0-2026-7406)
Vulnerability from cvelistv5 – Published: 2026-08-06 16:31 – Updated: 2026-08-07 18:30
VLAI
EPSS
VEX
Title
BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products
Summary
A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-822 - Untrusted Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Revit |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.5.0 (semver) Affected: 2024.0.0 , < 2024.3.5 (semver) cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD LT |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:* |
|
| Autodesk | DWG TrueView |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7406",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T15:32:33.647250Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T15:35:08.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.5.0",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
},
{
"lessThan": "2024.3.5",
"status": "affected",
"version": "2024.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD LT",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "DWG TrueView",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-822",
"description": "CWE-822 Untrusted Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:30:23.049Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-7406",
"datePublished": "2026-08-06T16:31:12.298Z",
"dateReserved": "2026-04-29T13:03:51.562Z",
"dateUpdated": "2026-08-07T18:30:23.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7405 (GCVE-0-2026-7405)
Vulnerability from cvelistv5 – Published: 2026-08-06 16:17 – Updated: 2026-08-07 18:30
VLAI
EPSS
VEX
Title
TIF File Parsing Out-of-Bounds Read in certain Autodesk products
Summary
A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-Bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Revit |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.5.0 (semver) Affected: 2024.0.0 , < 2024.3.5 (semver) cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD LT |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:* |
|
| Autodesk | DWG TrueView |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7405",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:22:24.248444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:22:51.825Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.5.0",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
},
{
"lessThan": "2024.3.5",
"status": "affected",
"version": "2024.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD LT",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "DWG TrueView",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service"
}
],
"value": "A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service"
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:30:02.441Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "TIF File Parsing Out-of-Bounds Read in certain Autodesk products",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-7405",
"datePublished": "2026-08-06T16:17:54.589Z",
"dateReserved": "2026-04-29T13:03:48.953Z",
"dateUpdated": "2026-08-07T18:30:02.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11803 (GCVE-0-2026-11803)
Vulnerability from cvelistv5 – Published: 2026-08-06 15:58 – Updated: 2026-08-08 03:55
VLAI
EPSS
VEX
Title
PDF File Parsing Out-of-Bounds Read Vulnerability in Autodesk Revit
Summary
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-Bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T03:55:29.449Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.2.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.5.0",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:58:36.195Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0011"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "PDF File Parsing Out-of-Bounds Read Vulnerability in Autodesk Revit",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-11803",
"datePublished": "2026-08-06T15:58:36.195Z",
"dateReserved": "2026-06-09T15:00:58.771Z",
"dateUpdated": "2026-08-08T03:55:29.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8325 (GCVE-0-2026-8325)
Vulnerability from cvelistv5 – Published: 2026-08-06 15:58 – Updated: 2026-08-08 03:55
VLAI
EPSS
VEX
Title
PDF File Parsing Out-of-Bounds Write Vulnerability in Autodesk Revit
Summary
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-Bounds Write
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8325",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T03:55:30.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.2.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.5.0",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-Bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:58:02.242Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0011"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "PDF File Parsing Out-of-Bounds Write Vulnerability in Autodesk Revit",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-8325",
"datePublished": "2026-08-06T15:58:02.242Z",
"dateReserved": "2026-05-11T14:02:24.198Z",
"dateUpdated": "2026-08-08T03:55:30.658Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1289 (GCVE-0-2026-1289)
Vulnerability from cvelistv5 – Published: 2026-08-06 15:57 – Updated: 2026-08-08 03:55
VLAI
EPSS
VEX
Title
PDF File Parsing Use-After-Free Vulnerability in Autodesk Revit
Summary
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T03:55:31.741Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.2.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.5.0",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153: Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:57:13.827Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0011"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "PDF File Parsing Use-After-Free Vulnerability in Autodesk Revit",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-1289",
"datePublished": "2026-08-06T15:57:13.827Z",
"dateReserved": "2026-01-21T14:43:33.946Z",
"dateUpdated": "2026-08-08T03:55:31.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10710 (GCVE-0-2026-10710)
Vulnerability from cvelistv5 – Published: 2026-08-04 12:59 – Updated: 2026-08-05 03:56
VLAI
EPSS
VEX
Title
FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK
Summary
A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10710",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T03:56:13.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:fbx_sdk:2020.3.9:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FBX SDK",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2020.3.10",
"status": "affected",
"version": "2020.3.9",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T12:59:51.310Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0010"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-10710",
"datePublished": "2026-08-04T12:59:51.310Z",
"dateReserved": "2026-06-02T18:11:05.634Z",
"dateUpdated": "2026-08-05T03:56:13.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10709 (GCVE-0-2026-10709)
Vulnerability from cvelistv5 – Published: 2026-08-04 12:59 – Updated: 2026-08-05 03:56
VLAI
EPSS
VEX
Title
FBX BinaryReadSectionHeader Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK
Summary
A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10709",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T03:56:14.471Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:fbx_sdk:2020.3.9:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FBX SDK",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2020.3.10",
"status": "affected",
"version": "2020.3.9",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T12:59:07.257Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0010"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "FBX BinaryReadSectionHeader Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-10709",
"datePublished": "2026-08-04T12:59:07.257Z",
"dateReserved": "2026-06-02T18:11:04.411Z",
"dateUpdated": "2026-08-05T03:56:14.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17550 (GCVE-0-2026-17550)
Vulnerability from cvelistv5 – Published: 2026-07-29 15:23 – Updated: 2026-08-07 18:29
VLAI
EPSS
VEX
Title
DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD
Summary
A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/products/dwg-trueview/overview | patch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | AutoCAD |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD LT |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:* |
|
| Autodesk | DWG TrueView |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T17:57:10.529676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T17:57:17.958Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD LT",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "DWG TrueView",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information."
}
],
"value": "A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:29:35.690Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0009"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/dwg-trueview/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-17550",
"datePublished": "2026-07-29T15:23:16.031Z",
"dateReserved": "2026-07-27T12:14:33.962Z",
"dateUpdated": "2026-08-07T18:29:35.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16465 (GCVE-0-2026-16465)
Vulnerability from cvelistv5 – Published: 2026-07-29 15:22 – Updated: 2026-08-07 18:29
VLAI
EPSS
VEX
Title
DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD
Summary
A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/products/dwg-trueview/overview | patch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | AutoCAD |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD LT |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:* |
|
| Autodesk | DWG TrueView |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16465",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T15:55:09.293999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T15:55:18.403Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD LT",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "DWG TrueView",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information."
}
],
"value": "A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:29:17.003Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0009"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/dwg-trueview/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-16465",
"datePublished": "2026-07-29T15:22:42.203Z",
"dateReserved": "2026-07-21T13:11:00.568Z",
"dateUpdated": "2026-08-07T18:29:17.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16463 (GCVE-0-2026-16463)
Vulnerability from cvelistv5 – Published: 2026-07-29 15:22 – Updated: 2026-08-07 18:28
VLAI
EPSS
VEX
Title
DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD
Summary
A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
| https://www.autodesk.com/products/dwg-trueview/overview | patch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | AutoCAD |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:* |
|
| Autodesk | AutoCAD LT |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:* |
|
| Autodesk | DWG TrueView |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.1.2 (semver) cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:* cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16463",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T03:55:24.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "AutoCAD LT",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "DWG TrueView",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.1.2",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:28:40.494Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0009"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/dwg-trueview/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-16463",
"datePublished": "2026-07-29T15:22:16.305Z",
"dateReserved": "2026-07-21T13:10:56.170Z",
"dateUpdated": "2026-08-07T18:28:40.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10789 (GCVE-0-2026-10789)
Vulnerability from cvelistv5 – Published: 2026-06-22 17:15 – Updated: 2026-06-23 03:56
VLAI
EPSS
VEX
Title
MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop
Summary
A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://dl.appstreaming.autodesk.com/production/i… | patch |
| https://dl.appstreaming.autodesk.com/production/i… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10789",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T03:56:02.324Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:fusion:2703.1.11:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Fusion",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2703.1.20",
"status": "affected",
"version": "2703.1.11",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user."
}
],
"value": "A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-22T17:15:25.546Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008"
},
{
"tags": [
"patch"
],
"url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe"
},
{
"tags": [
"patch"
],
"url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-10789",
"datePublished": "2026-06-22T17:15:25.546Z",
"dateReserved": "2026-06-03T19:23:28.312Z",
"dateUpdated": "2026-06-23T03:56:02.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1288 (GCVE-0-2026-1288)
Vulnerability from cvelistv5 – Published: 2026-06-17 15:27 – Updated: 2026-06-17 17:30
VLAI
EPSS
VEX
Title
RFA File Parsing Vulnerability in Autodesk Revit
Summary
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Autodesk | Revit |
Affected:
2027.0.0 , < 2027.1.0
(semver)
Affected: 2026.0.0 , < 2026.4.1 (semver) Affected: 2025.0.0 , < 2025.4.5 (semver) Affected: 2024.0.0 , < 2024.3.5 (semver) cpe:2.3:a:autodesk:revit:2027.1:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2026.4.1:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2025.4.5:*:*:*:*:*:*:* cpe:2.3:a:autodesk:revit:2024.3.5:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T17:30:34.311655Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T17:30:51.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:revit:2027.1:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2026.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2025.4.5:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:revit:2024.3.5:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Revit",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1.0",
"status": "affected",
"version": "2027.0.0",
"versionType": "semver"
},
{
"lessThan": "2026.4.1",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
},
{
"lessThan": "2025.4.5",
"status": "affected",
"version": "2025.0.0",
"versionType": "semver"
},
{
"lessThan": "2024.3.5",
"status": "affected",
"version": "2024.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted RFA file, when converted to FormIt via \u201cConvert RFA to FormIt\u201d in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition."
}
],
"value": "A maliciously crafted RFA file, when converted to FormIt via \u201cConvert RFA to FormIt\u201d in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153: Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T15:27:54.195Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0007"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "RFA File Parsing Vulnerability in Autodesk Revit",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-1288",
"datePublished": "2026-06-17T15:27:54.195Z",
"dateReserved": "2026-01-21T14:43:31.726Z",
"dateUpdated": "2026-06-17T17:30:51.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7454 (GCVE-0-2026-7454)
Vulnerability from cvelistv5 – Published: 2026-05-26 17:09 – Updated: 2026-05-27 03:55
VLAI
EPSS
VEX
Title
WRL File Parsing Memory Corruption in Autodesk 3ds Max
Summary
A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.autodesk.com/trust/security-advisorie… | vendor-advisory |
| https://www.autodesk.com/products/autodesk-access… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7454",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T03:55:55.888Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:autodesk:3ds_max:2027:*:*:*:*:*:*:*",
"cpe:2.3:a:autodesk:3ds_max:2026:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "3ds Max",
"vendor": "Autodesk",
"versions": [
{
"lessThan": "2027.1",
"status": "affected",
"version": "2027",
"versionType": "custom"
},
{
"lessThan": "2026.1",
"status": "affected",
"version": "2026",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"value": "A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T17:09:08.952Z",
"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"shortName": "autodesk"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0006"
},
{
"tags": [
"patch"
],
"url": "https://www.autodesk.com/products/autodesk-access/overview"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WRL File Parsing Memory Corruption in Autodesk 3ds Max",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601",
"assignerShortName": "autodesk",
"cveId": "CVE-2026-7454",
"datePublished": "2026-05-26T17:09:08.952Z",
"dateReserved": "2026-04-29T17:19:13.538Z",
"dateUpdated": "2026-05-27T03:55:55.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}