Description
A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Published: 2026-08-06
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution
Action: Immediate Patch
AI Analysis

Impact

A maliciously crafted PDF file, when parsed through the Autodesk Revit PDF parser, forces an out‑of‑bounds write that corrupts memory. This flaw can crash the application, corrupt data or enable an attacker to execute arbitrary code in the context of the running process. The underlying weakness is a classic buffer overwrite, classified as CWE‑787.

Affected Systems

Autodesk Revit versions 2024, 2025, 2026, and 2027 are affected. The likely attack vector involves opening or importing PDF files through Revit's default parser, but this is inferred from the description.

Risk and Exploitability

The CVSS score of 7.8 signals a medium‑high risk. An EPSS score of <1% indicates a low but nonzero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector involves delivering a specially crafted PDF to a user, possibly via a local file or a network source, which could lead to arbitrary code execution within the application, but this is inferred from the description.

Generated by OpenCVE AI on September 21, 2026 at 07:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Autodesk Revit security patch described in the Autodesk Security Advisory ADK-SA-2026-0011.
  • Avoid opening PDF files from untrusted or unknown sources; treat PDFs as untrusted content.
  • Run Revit in a sandbox or restrict the application to a least‑privilege user context to contain potential code execution.

Generated by OpenCVE AI on September 21, 2026 at 07:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
Description A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Title PDF File Parsing Out-of-Bounds Write Vulnerability in Autodesk Revit PDF File Parsing Out-of-Bounds Write Vulnerability in Certain Autodesk Desktop Products

Fri, 04 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*

Fri, 21 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:revit:2025:*:*:*:*:*:*:*

Fri, 07 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Title PDF File Parsing Out-of-Bounds Write Vulnerability in Autodesk Revit
First Time appeared Autodesk
Autodesk revit
Weaknesses CWE-787
CPEs cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*
Vendors & Products Autodesk
Autodesk revit
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Autodesk Revit
cve-icon MITRE

Status: PUBLISHED

Assigner: autodesk

Published:

Updated: 2026-09-17T13:50:34.232Z

Reserved: 2026-05-11T14:02:24.198Z

Link: CVE-2026-8325

cve-icon Vulnrichment

Updated: 2026-08-07T15:24:48.724Z

cve-icon NVD

Status : Modified

Published: 2026-08-06T22:18:33.243

Modified: 2026-09-17T14:17:52.297

Link: CVE-2026-8325

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T07:30:08Z

Weaknesses