Autodesk
384 CVEs across 116 Autodesk products. Browse Autodesk vulnerabilities, severities, and proof-of-concept exploits.
Autodesk products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85217 | High | 8.6 | 2026-09-10 | A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or… |
CVE-2026-14255 | Medium | 5.5 | 2026-09-02 | A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may lever… |
CVE-2026-7455 | High | 7.8 | 2026-08-24 | A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulne… |
CVE-2026-19568 | High | 7.8 | 2026-08-24 | A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerab… |
CVE-2026-16783 | High | 7.8 | 2026-08-24 | A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulne… |
CVE-2026-16782 | Medium | 5.3 | 2026-08-24 | A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulner… |
CVE-2026-16781 | Medium | 5.5 | 2026-08-24 | A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this… |
CVE-2026-14479 | Medium | 5.5 | 2026-08-12 | A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offse… |
CVE-2026-14478 | High | 7.8 | 2026-08-12 | A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into… |
CVE-2026-8325 | High | 7.8 | 2026-08-06 | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Write vulnerability. A malicious actor may leverage th… |
CVE-2026-7406 | High | 7.8 | 2026-08-06 | A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can l… |
CVE-2026-7405 | Medium | 5.5 | 2026-08-06 | A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling librar… |
CVE-2026-1289 | High | 7.8 | 2026-08-06 | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vu… |
CVE-2026-11803 | High | 7.8 | 2026-08-06 | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage thi… |
CVE-2026-10710 | High | 7.8 | 2026-08-04 | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malici… |
CVE-2026-10709 | High | 7.8 | 2026-08-04 | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSecti… |
CVE-2026-17550 | Medium | 5.5 | 2026-07-29 | A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this… |
CVE-2026-16465 | Medium | 6.1 | 2026-07-29 | A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this… |
CVE-2026-16463 | High | 7.8 | 2026-07-29 | A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulner… |
CVE-2026-10789 | Critical | 9.6 | 2026-06-22 | A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MC… |
CVE-2026-1288 | Medium | 5.5 | 2026-06-17 | A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Suc… |
CVE-2026-7454 | High | 7.8 | 2026-05-26 | A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerab… |
CVE-2026-7453 | Medium | 5.5 | 2026-05-26 | A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition. |
CVE-2026-7452 | High | 7.8 | 2026-05-26 | A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerab… |
CVE-2026-7451 | High | 7.8 | 2026-05-26 | A maliciously crafted TIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulne… |
CVE-2026-7450 | Medium | 5.5 | 2026-05-26 | A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the… |
CVE-2026-4369 | High | 7.1 | 2026-04-14 | A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Store… |
CVE-2026-4345 | High | 7.1 | 2026-04-14 | A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk… |
CVE-2026-4344 | High | 7.1 | 2026-04-14 | A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-… |
CVE-2026-0875 | High | 7.8 | 2026-02-18 | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage… |
CVE-2026-0874 | High | 7.8 | 2026-02-18 | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may levera… |
CVE-2026-0536 | High | 7.8 | 2026-02-04 | A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage thi… |
CVE-2026-0662 | High | 7.8 | 2026-02-04 | A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current p… |
CVE-2026-0661 | High | 8.4 | 2026-02-04 | A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerab… |
CVE-2026-0660 | High | 8.4 | 2026-02-04 | A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage thi… |
CVE-2026-0659 | High | 7.8 | 2026-02-04 | A maliciously crafted USD file, when loaded or imported into Autodesk Arnold or Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious a… |
CVE-2026-0538 | High | 8.4 | 2026-02-04 | A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulne… |
CVE-2026-0537 | High | 8.4 | 2026-02-04 | A maliciously crafted RGB file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerab… |
CVE-2026-0535 | High | 8.1 | 2026-01-22 | A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in… |
CVE-2026-0534 | High | 8.1 | 2026-01-22 | A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Au… |
CVE-2026-0533 | High | 8.1 | 2026-01-22 | A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-sit… |
CVE-2025-9460 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage… |
CVE-2025-9459 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage… |
CVE-2025-9457 | High | 7.8 | 2025-12-16 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this… |
CVE-2025-9456 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage t… |
CVE-2025-9455 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leve… |
CVE-2025-9454 | High | 7.8 | 2025-12-16 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage th… |
CVE-2025-9453 | High | 7.8 | 2025-12-16 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage th… |
CVE-2025-9452 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage t… |
CVE-2025-14593 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverag… |
CVE-2025-10900 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10899 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10898 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10889 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage… |
CVE-2025-10888 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10887 | High | 7.8 | 2025-12-16 | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage th… |
CVE-2025-10886 | High | 7.8 | 2025-12-16 | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage th… |
CVE-2025-10884 | High | 7.8 | 2025-12-16 | AA maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may lever… |
CVE-2025-10883 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can lev… |
CVE-2025-10882 | High | 7.8 | 2025-12-16 | AA maliciously crafted X_T file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage… |
CVE-2025-10881 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leve… |
CVE-2025-11797 | High | 7.8 | 2025-11-12 | A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerabili… |
CVE-2025-11795 | High | 7.8 | 2025-11-12 | A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulne… |
CVE-2025-9458 | High | 7.8 | 2025-11-07 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this… |
CVE-2025-10885 | High | 7.8 | 2025-11-06 | A maliciously crafted file, when executed on the victim's machine, can lead to privilege escalation to NT AUTHORITY/SYSTEM due to an insufficient validation of… |
CVE-2025-8354 | High | 7.8 | 2025-09-23 | A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability… |
CVE-2025-10244 | High | 8.7 | 2025-09-23 | A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A… |
CVE-2025-8892 | High | 7.8 | 2025-09-22 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this… |
CVE-2025-8894 | High | 7.8 | 2025-09-16 | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage th… |
CVE-2025-8893 | High | 7.8 | 2025-09-16 | A maliciously crafted PDF file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage t… |
CVE-2025-5048 | High | 7.8 | 2025-08-15 | A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force a Memory Corruption vulnerability. A malicious actor can leverage this… |
CVE-2025-5047 | High | 7.8 | 2025-08-15 | A maliciously crafted DGN file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vu… |
CVE-2025-5046 | High | 7.8 | 2025-08-15 | A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage th… |
CVE-2025-6634 | High | 7.8 | 2025-08-06 | A maliciously crafted TGA file, when linked or imported into Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this… |
CVE-2025-6633 | High | 7.8 | 2025-08-06 | A maliciously crafted RBG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulne… |
CVE-2025-6632 | Medium | 5.3 | 2025-08-06 | A maliciously crafted PSD file, when linked or imported into Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage th… |
CVE-2025-7675 | High | 7.8 | 2025-07-29 | A maliciously crafted 3DM file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage t… |
CVE-2025-7497 | High | 7.8 | 2025-07-29 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage t… |
CVE-2025-6637 | High | 7.8 | 2025-07-29 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage t… |
CVE-2025-6636 | High | 7.8 | 2025-07-29 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vu… |
CVE-2025-6635 | High | 7.8 | 2025-07-29 | A maliciously crafted PRT file, when linked or imported into certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can le… |
CVE-2025-6631 | High | 7.8 | 2025-07-29 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage t… |
CVE-2025-5043 | High | 7.8 | 2025-07-29 | A maliciously crafted 3DM file, when linked or imported into certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can le… |
CVE-2025-5038 | High | 7.8 | 2025-07-29 | A maliciously crafted X_T file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this… |
CVE-2025-5039 | High | 7.8 | 2025-07-24 | A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context… |
CVE-2025-5042 | High | 7.8 | 2025-07-22 | A maliciously crafted RFA file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerab… |
CVE-2025-5040 | High | 7.8 | 2025-07-10 | A maliciously crafted RTE file, when parsed through Autodesk Revit, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerab… |
CVE-2025-5037 | High | 7.8 | 2025-07-10 | A maliciously crafted RFA, RTE, or RVT file, when parsed through Autodesk Revit, can force a Memory Corruption vulnerability. A malicious actor can leverage th… |
CVE-2025-4605 | Medium | 6.6 | 2025-06-11 | A maliciously crafted .usdc file, when loaded through Autodesk Maya, can force an uncontrolled memory allocation vulnerability. A malicious actor may leverage… |
CVE-2025-5335 | High | 7.8 | 2025-06-10 | A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized… |
CVE-2025-5036 | High | 7.8 | 2025-06-02 | A maliciously crafted RFA file, when linked or imported into Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vuln… |
CVE-2025-2497 | High | 7.8 | 2025-04-15 | A maliciously crafted DWG file, when parsed through Autodesk Revit, can cause a Stack-Based Buffer Overflow vulnerability. A malicious actor can leverage this… |
CVE-2025-1656 | High | 7.8 | 2025-04-15 | A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can levera… |
CVE-2025-1277 | High | 7.8 | 2025-04-15 | A maliciously crafted PDF file, when parsed through Autodesk applications, can force a Memory Corruption vulnerability. A malicious actor can leverage this vul… |
CVE-2025-1276 | High | 7.8 | 2025-04-15 | A maliciously crafted DWG file, when parsed through certain Autodesk applications, can force an Out-of-Bounds Write vulnerability. A malicious actor may levera… |
CVE-2025-1275 | High | 7.8 | 2025-04-15 | A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor ca… |
CVE-2025-1274 | High | 7.8 | 2025-04-15 | A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnera… |
CVE-2025-1273 | High | 7.8 | 2025-04-15 | A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can levera… |
CVE-2025-1660 | High | 7.8 | 2025-04-01 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vuln… |
CVE-2025-1659 | High | 7.8 | 2025-04-01 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vu… |