Description
A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Published: 2026-07-29
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A maliciously crafted DXF file causes the AutoCAD parser to overflow a heap buffer, leading to a crash, data leakage, or execution of arbitrary code in the context of the current process. This qualifies as a Heap‑Based Buffer Overflow (CWE‑122).

Affected Systems

The vulnerability impacts Autodesk AutoCAD, AutoCAD LT, and DWG TrueView. While explicit version numbers are not listed, the CPE entries reference version 2027, suggesting those releases are affected.

Risk and Exploitability

The CVSS score of 7.8 reflects high severity. The EPSS score of less than 1% indicates that the likelihood of exploitation is low, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector requires a malicious DXF file to be opened locally by a user, so the risk is confined to environments allowing end‑users to import arbitrary files. Without an active patch, a successful exploitation would allow code execution with the privileges of the AutoCAD session.

Generated by OpenCVE AI on August 3, 2026 at 13:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s latest patch or update AutoCAD, AutoCAD LT, and DWG TrueView to the newest release.
  • Restrict the import of DXF files to authenticated users or trusted sources only, and consider disabling the feature if not needed.
  • Run AutoCAD with the least privilege necessary and use a sandbox or virtualized environment to limit damage from potential exploitation.

Generated by OpenCVE AI on August 3, 2026 at 13:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Autodesk advance Steel
Autodesk autocad Architecture
Autodesk autocad Electrical
Autodesk autocad Map 3d
Autodesk autocad Mechanical
Autodesk autocad Mep
Autodesk autocad Plant 3d
Autodesk civil 3d
CPEs cpe:2.3:a:autodesk:advance_steel:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:advance_steel:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_architecture:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_architecture:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_electrical:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_electrical:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_lt:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:-:*:*
cpe:2.3:a:autodesk:autocad_map_3d:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_map_3d:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_mechanical:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_mechanical:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_mep:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_mep:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_plant_3d:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_plant_3d:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:civil_3d:*:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:civil_3d:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:dwg_trueview:*:*:*:*:*:*:*:*
Vendors & Products Autodesk advance Steel
Autodesk autocad Architecture
Autodesk autocad Electrical
Autodesk autocad Map 3d
Autodesk autocad Mechanical
Autodesk autocad Mep
Autodesk autocad Plant 3d
Autodesk civil 3d

Fri, 07 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*

Wed, 29 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Title DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD
First Time appeared Autodesk
Autodesk autocad
Autodesk autocad Lt
Autodesk dwg Trueview
Weaknesses CWE-122
CPEs cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*
Vendors & Products Autodesk
Autodesk autocad
Autodesk autocad Lt
Autodesk dwg Trueview
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Autodesk Advance Steel Autocad Autocad Architecture Autocad Electrical Autocad Lt Autocad Map 3d Autocad Mechanical Autocad Mep Autocad Plant 3d Civil 3d Dwg Trueview
cve-icon MITRE

Status: PUBLISHED

Assigner: autodesk

Published:

Updated: 2026-08-07T18:28:40.494Z

Reserved: 2026-07-21T13:10:56.170Z

Link: CVE-2026-16463

cve-icon Vulnrichment

Updated: 2026-07-29T15:54:54.618Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-29T16:17:50.377

Modified: 2026-08-12T20:19:57.717

Link: CVE-2026-16463

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T13:30:04Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow