A maliciously crafted PDF file, when parsed through Autodesk Revit, can trigger a Use‑After‑Free vulnerability. A malicious actor can cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process. This flaw occurs due to improper memory management during PDF parsing and is classified as CWE‑416. Any user who can supply or deliver a crafted PDF to an affected Autodesk Revit installation is at risk. The vulnerability can compromise confidentiality, integrity, and availability of the application and the underlying system.

Autodesk AutoCAD, AutoCAD LT, DWG TrueView, and Revit releases from 2024 through 2027 are affected. Users of any of these versions on supported platforms may be vulnerable if they open a maliciously crafted PDF file. The vulnerability resides in the core PDF parsing component of these applications.

The CVSS base score is 7.8, indicating high severity. The EPSS score is <1% (≈0.00193), suggesting a very low baseline exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by providing a malicious PDF to any user who opens it; therefore, the likely attack vector is a local or distant document open. Once the attack succeeds, the attacker can gain code execution privileges with the same rights as the affected process, potentially compromising the underlying operating system.