A vulnerability in Autodesk Fusion Desktop allows an attacker to load a malicious dynamic library from an arbitrary path through the exposed TextCommands.LoadDll command in the API. Loading such a library triggers an exposed dangerous function within Fusion, giving the attacker the ability to run arbitrary code with the same privileges as the Fusion process. This results in a full compromise of confidentiality, integrity, and availability for the affected system.

Autodesk Fusion Desktop, version 2705.1.30, and potentially other installations on the same major release. The vulnerability affects the Fusion client application on the operating systems for which the provided installers exist (macOS and Windows).

The CVSS score of 7.8 marks this flaw as high severity. The EPSS score is not available, so an estimate of exploitation probability cannot be derived from that metric, and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to invoke the TextCommands.LoadDll API, which usually involves the attacker running or influencing a script or plugin within Fusion. Thus the attack vector likely needs user interaction or elevated privileges within the Fusion environment. If successful, the malicious DLL can execute code in the context of the current Fusion process, providing the attacker with the same user rights.