Autodesk Shared Components CVE-2025-10882

Exploitation requires a victim to open or parse a maliciously crafted X_T (Siemens Parasolid) model file within an affected Autodesk product that uses the vulnerable Shared Components. The CVSS vector (AV:L, UI:R) confirms this is a local, user-interaction-dependent attack - there is no network-facing or unauthenticated remote trigger. Limiting factors: the attacker must deliver the file and socially engineer the user into opening it, exploitation runs only in the context of the current user (S:U, no privilege escalation), and only products bundling the affected Shared Components that process X_T/Parasolid data are impacted.

This is a classic client-side file-parsing memory-corruption flaw rather than a remotely-reachable server vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms a local attack vector requiring user interaction - the victim must open or process a maliciously crafted X_T (Parasolid) file - but no authentication, which is why the base score reaches 7.8 (HIGH) with full C:H/I:H/A:H impact. No EPSS score, CISA KEV listing, SSVC decision data, or public POC is present in the provided intelligence, so there is no signal of active or imminent exploitation; the 'RCE' and 'Memory Corruption' tags describe the vulnerability class, not confirmed weaponization. Exploitation status is therefore 'no public exploit identified at time of analysis.' The realistic priority is MEDIUM: code execution is possible and the affected Shared Components are embedded across many Autodesk products, but the requirement for a user to open an attacker-supplied CAD file (not a drive-by or network trigger) meaningfully constrains mass exploitation and makes this more suited to targeted spear-phishing than worm-like spread. No conflicting signals were observed between the CVSS vector and the description - both consistently indicate local, user-interaction-dependent exploitation.

An attacker emails or shares a booby-trapped Parasolid (.x_t) model file to an engineer or designer, who opens it in an affected Autodesk application. Parsing the malformed file triggers an out-of-bounds write that corrupts memory and allows arbitrary code execution in the context of the logged-in user. No public exploit code is identified at the time of analysis, so weaponization would require the attacker to develop a working exploit.