A maliciously crafted MODEL file can trigger an out-of-bounds write when parsed by Autodesk products. This bug can corrupt memory, cause the application to crash, or allow an attacker to execute arbitrary code in the context of the current process. The vulnerability is a classic buffer overflow identified as CWE-787. It directly compromises the confidentiality, integrity, or availability of the application.

The affected products are all Autodesk applications released in the 2026 cycle, including 3ds Max 2026, Advance Steel 2026, AutoCad 2026 variants (Architecture, Electrical, Map 3D, Mechanical, MEP, Plant 3D), Civil 3D 2026, Infraworks 2026, Inventor 2026, Revit 2026, Revit LT 2026, and Vault 2026. The Shared Components package is also impacted, with versions up to 2026.5. Users of any of these 2026 releases should review the advisory to verify whether they are running a vulnerable build.

The CVSS score is 7.8, indicating high severity, but the EPSS score is less than 1%, so exploitation likelihood is currently low. The bug is not listed as a known exploited vulnerability in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires a user to open or import the crafted MODEL file locally. An attacker would need to supply the file to the victim’s machine, making remote exploitation difficult without a lateral move or social engineering. Once triggered, the out-of-bounds write could lead to program crash, data corruption, or code execution if the attacker can control the memory content.