CVE-2026-7406High· 7.8▾ TwilightA maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the cur…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
0.1% → 0.2%
A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
advance_steel >= 2027, < 2027.1autocad >= 2027, < 2027.1autocad_architecture >= 2027, < 2027.1autocad_electrical >= 2027, < 2027.1autocad_lt >= 2027, < 2027.1autocad_map_3d >= 2027, < 2027.1autocad_mechanical >= 2027, < 2027.1autocad_mep >= 2027, < 2027.1autocad_plant_3d >= 2027, < 2027.1civil_3d >= 2027, < 2027.1dwg_trueview >= 2027, < 2027.1revit >= 2025, < 2025.3.5revit >= 2026, < 2026.5revit >= 2027, < 2027.1Upgrade past the affected range:
advance_steel 2027.1autocad 2027.1autocad_architecture 2027.1autocad_electrical 2027.1autocad_lt 2027.1autocad_map_3d 2027.1autocad_mechanical 2027.1autocad_mep 2027.1autocad_plant_3d 2027.1civil_3d 2027.1dwg_trueview 2027.1revit 2027.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-7405Medium· 5.5A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library
CVE-2026-14255Medium· 5.5IFC File Parsing Uncontrolled Recursion in Certain Autodesk Products
CVE-2026-15102High· 7.5ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text
CVE-2023-41139High· 7.8A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer
CVE-2022-25788High· 7.8A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT files
CVE-2021-40158High· 7.8A maliciously crafted JT file in Autodesk Inventor 2022, 2021, 2020, 2019 and AutoCAD 2022 may be forced to read beyond allocated boundaries when parsing the JT file