A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out‑of‑Bounds Read vulnerability that may cause a crash, leak sensitive memory contents, or execute arbitrary code within the current process. This vulnerability reflects a failure to validate input bounds correctly, and is classified as CWE‑125.

All Autodesk desktop products listed in the CVE—AutoCAD, AutoCAD LT, and Revit—covering 2024 through 2027 releases are affected. The vulnerability applies to the general product lines with these release years, meaning users with any of these versions and both standard and LT editions should consider themselves vulnerable until a corrective update is installed. Specific sub‑versions beyond the listed years are not documented, so any build within the affected ranges is presumed impacted.

The CVSS base score of 7.8 marks the issue as high severity, while the EPSS score below 1% indicates a low but non‑zero likelihood of exploitation at the current moment. Because the attack vector hinges on opening a malicious PDF, it can be delivered via email attachments, shared network files, or automated import processes, which are typical in design and engineering environments. The absence of a CISA KEV listing does not mitigate the risk; any process that renders PDFs from user input remains a potential entry point. Prompt application of vendor patches and disabling automatic PDF rendering are recommended to mitigate these risks.