What is the CVSS score of CVE-2025-10881?

CVE-2025-10881 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Which versions of Autodesk Shared Components are affected by CVE-2025-10881?

CVE-2025-10881 affects Autodesk Shared Components, the shared file-parsing library used by multiple Autodesk applications to read CATIA V5 CATPRODUCT product and assembly files.

How to fix or mitigate CVE-2025-10881?

Within 24 hours, inventory all Autodesk products and versions that use Shared Components, identify users and workflows that open CATIA V5 CATPRODUCT/CATPart files, and issue an advisory to open only files from trusted sources; where feasible, block these file types at email and web gateways and confirm engineering accounts do not run with local administrator rights. Within 7 days, validate presence of affected shared libraries across endpoints and servers, implement application allowlisting or EDR detections for suspicious Autodesk child processes and anomalous file-open behavior, and restrict or sandbox opening of untrusted CATIA V5 files while monitoring vendor advisories for an exact fix version. Within 30 days, apply the vendor patch as soon as it is released, verify coverage across all affected products/versions, and review file-exchange workflows to require trusted repositories or content disarm and reconstruction. Patch status: No vendor-released patch identified at time of analysis; exploitation status: no public exploit identified at time of analysis.

Autodesk Shared Components CVE-2025-10881

HIGH

Heap-based Buffer Overflow (CWE-122)

2025-12-16 psirt@autodesk.com

RCE Buffer Overflow Information Disclosure Heap Overflow Shared Components

7.8

CVSS 3.1 · Vendor: autodesk

Severity by source

Vendor (autodesk) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File must be locally opened by a user so AV:L and UI:R; no auth or config prerequisites (PR:N, AC:L); heap overflow enables code exec giving full C/I/A within the unchanged process scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (autodesk).

CVSS VectorVendor: autodesk

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 17, 2026 - 14:36 vuln.today

CVE Published

Dec 16, 2025 - 00:15 cve.org

HIGH 7.8

DescriptionCVE.org

A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

AnalysisAI

Heap-based buffer overflow in Autodesk Shared Components - the shared file-parsing libraries used by multiple Autodesk applications to read CATIA V5 CATPRODUCT product/assembly files - allows an attacker who convinces a user to open a crafted file to crash the application, read sensitive memory contents, or execute arbitrary code in the context of the current process. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, user-interaction-driven attack: no authentication to the host is required, but the attacker must first deliver the file to the victim and the victim must explicitly open it, and impact stays within the privileges of the user running the Autodesk product. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-122, a heap-based buffer overflow, in the shared components Autodesk products use to import CATIA V5 CATPRODUCT data. CATPRODUCT files are container-like structures describing products and assemblies; when the parser walks the malformed internal structures of an attacker-controlled file it writes or reads past the bounds of a heap-allocated buffer. Because this code sits in a shared parsing library (tracked as cpe:2.3:a:autodesk:shared_components with a wildcard version, i.e. all builds affected by the advisory), any Autodesk application that loads the vulnerable translator inherits the bug; the tag set (RCE, Buffer Overflow, Heap Overflow, Information Disclosure, Shared Components) and the C:H/I:H/A:H CVSS sub-scores are consistent with a memory-corruption primitive that can be steered toward crash, memory disclosure, or code execution. The malformed file structure itself is the trigger condition - there is no network-reachable endpoint or prior access required beyond getting the file in front of the victim.

RemediationAI

Autodesk has published security advisory adsk-sa-2025-0024 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0024); no exact patched version number is provided in the available CVE data, so treat remediation as 'patch available per vendor advisory' and apply the updated Shared Components/affected product builds listed there as soon as they are released. Until patched builds are deployed, treat CATPRODUCT files as untrusted input: block .CATProduct (and archive formats that can carry them) at the email gateway and web proxy, and quarantine files arriving from suppliers, shared drives, or downloads - accepting the trade-off that legitimate CATIA collaboration workflows will require an approved, scanned intake path. Open untrusted CAD files inside a disposable virtual machine or Windows Defender Application Guard/AppContainer sandbox running the Autodesk product, so that a memory-corruption failure is contained to the sandbox rather than the user's desktop; this costs performance and requires a non-persistent image but directly blunts the AV:L/UI:R vector. Run Autodesk applications with standard user rights, never as administrator, to limit the value of code execution in the user context, and enforce Mark-of-the-Web/Protected View-style prompts so that files from the internet require an explicit extra click. Enable EDR/exploit-protection (heap integrity, ASLR/DEP/CET, and exploit-mitigation policies on the Autodesk executables) to detect or prevent heap-overflow exploitation attempts; these controls reduce but do not eliminate risk. Finally, restrict and monitor which users have CATIA import/translate capabilities installed, and remove unused CAD translators via the Autodesk installer - a reduction in functionality that shrinks the attack surface for users who never open foreign CATPRODUCT data.