A specially crafted CATPART file triggers an out‑of‑bounds write in several Autodesk applications, including 3ds Max, AutoCAD families, and Revit. The flaw can cause the application to crash or corrupt data, and in the worst case it enables execution of arbitrary code in the context of the running process. The vulnerability is classified as a memory corruption weakness (CWE‑787).

Affected products include Autodesk 3ds Max 2026, Autodesk Advance Steel 2026, multiple AutoCAD variants (AutoCAD, Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D) 2026, Autodesk Civil 3D 2026, Autodesk Infraworks 2026, Autodesk Inventor 2026, Autodesk Revit 2026 and Revit LT 2026, Autodesk Shared Components (2026 and 2026.5), and Autodesk Vault 2026.

The CVSS score of 7.8 indicates a high severity risk, yet the EPSS probability is less than one percent, suggesting that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector likely involves a malicious user opening a corrupted CATPART file within an authenticated, local session, which would allow the attacker to gain code execution on the machine that hosts the application. No known exploitation beyond crashes and data corruption is documented, but the potential for arbitrary code execution makes the flaw critical if exploited.