{"id":"CVE-2026-14255","title":"IFC File Parsing Uncontrolled Recursion in Certain Autodesk Products","summary":"A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, res…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-674"],"vendor":"Autodesk","product":"Shared Components","affected":["shared_components >= 1.11.0 < 1.12.0","shared_components >= 2.0.0 < 2.2.0","Revit >= 2027.0.0 < 2027.3.0","Revit >= 2026.0.0 < 2026.5.1","Revit >= 2025.0.0 < 2025.5.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-02T14:37:00.684126Z"},"published":"2026-09-02","updated":"2026-10-27","sourceUpdated":"2026-10-27T17:46:26.857Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-14255","references":[{"url":"https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0015"},{"url":"https://www.autodesk.com/products/autodesk-access/overview"}],"tags":["cve.org"],"epss":0.00162,"epssPercentile":0.0536,"ingestedAt":"2026-10-27T16:32:34.406Z","slug":"CVE-2026-14255","body":"## Overview\n\nA maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-service. Exploitation requires a user to open a specially crafted IFC file.\n\n## Affected\n\n- `shared_components >= 1.11.0 < 1.12.0`\n- `shared_components >= 2.0.0 < 2.2.0`\n- `Revit >= 2027.0.0 < 2027.3.0`\n- `Revit >= 2026.0.0 < 2026.5.1`\n- `Revit >= 2025.0.0 < 2025.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}