Description
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Published: 2026-08-06
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution within Autodesk applications
Action: Immediate Patch
AI Analysis

Impact

A specially crafted PDF file, when parsed by Autodesk Revit or other desktop products, can cause an out‑of‑bounds write that may crash the application, corrupt data or allow arbitrary code execution within the current process. The weakness is a classic buffer overwrite classified as CWE-787.

Affected Systems

Autodesk products affected by this vulnerability include AutoCAD (versions 2024‑2027), AutoCAD LT (2024‑2027), DWG TrueView (2024‑2027) and Revit (all versions, 2024‑2027).

Risk and Exploitability

The CVSS score of 7.8 places the flaw in the medium‑to‑high risk range, while the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. According to the description, the likely attack vector involves a malicious actor delivering a crafted PDF to a user through local files or network sources and then opening or importing that PDF within the affected Autodesk product, which could lead to arbitrary code execution in the application’s process.

Generated by OpenCVE AI on October 19, 2026 at 14:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security patch or update to the newest version of the affected Autodesk product as specified in the Autodesk Security Advisory ADK‑SA‑2026‑0011.
  • Avoid opening PDFs from untrusted or unknown sources; treat all PDF files as potentially malicious.
  • Run the Autodesk application in a sandboxed or least‑privileged user context to contain potential code execution.
  • Maintain up‑to‑date endpoint protection and monitor for abnormal application behavior to detect exploitation attempts.

Generated by OpenCVE AI on October 19, 2026 at 14:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Title PDF File Parsing Out-of-Bounds Write Vulnerability in Certain Autodesk Desktop Products PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products
First Time appeared Autodesk autocad
Autodesk autocad Lt
Autodesk dwg Trueview
CPEs cpe:2.3:a:autodesk:autocad:2024:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad:2025:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad:2026:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_lt:2024:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_lt:2025:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_lt:2026:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:autocad_lt:2027:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:dwg_trueview:2024:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:dwg_trueview:2025:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:dwg_trueview:2026:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:dwg_trueview:2027:*:*:*:*:*:*:*
Vendors & Products Autodesk autocad
Autodesk autocad Lt
Autodesk dwg Trueview

Thu, 17 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
Description A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Title PDF File Parsing Out-of-Bounds Write Vulnerability in Autodesk Revit PDF File Parsing Out-of-Bounds Write Vulnerability in Certain Autodesk Desktop Products

Fri, 04 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*

Fri, 21 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:autodesk:revit:2024:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:revit:2025:*:*:*:*:*:*:*

Fri, 07 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
Title PDF File Parsing Out-of-Bounds Write Vulnerability in Autodesk Revit
First Time appeared Autodesk
Autodesk revit
Weaknesses CWE-787
CPEs cpe:2.3:a:autodesk:revit:2026:*:*:*:*:*:*:*
cpe:2.3:a:autodesk:revit:2027:*:*:*:*:*:*:*
Vendors & Products Autodesk
Autodesk revit
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Autodesk Autocad Autocad Lt Dwg Trueview Revit
cve-icon MITRE

Status: PUBLISHED

Assigner: autodesk

Published:

Updated: 2026-10-19T12:24:17.192Z

Reserved: 2026-05-11T14:02:24.198Z

Link: CVE-2026-8325

cve-icon Vulnrichment

Updated: 2026-08-07T15:24:48.724Z

cve-icon NVD

Status : Modified

Published: 2026-08-06T22:18:33.243

Modified: 2026-10-24T13:10:00.147

Link: CVE-2026-8325

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T14:15:06Z

Weaknesses