Autodesk Shared Components CVE-2025-10883

Exploitation requires the victim to open or parse a maliciously crafted CATPRODUCT (CATIA assembly) file using an affected Autodesk product that relies on the vulnerable shared component; the flaw is reached specifically through that product's CATPRODUCT file-parsing path. Key limiting factors: the vector is LOCAL (AV:L) with no network or remote trigger, and mandatory user interaction (UI:R) means the attack fails unless a user is socially engineered into opening the attacker-supplied file. No special privileges or authentication are needed (PR:N) once the file is opened, and exploitation runs only in the context of the current user, not with elevated rights.

This is a genuine but not emergency-level priority. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly characterizes a client-side, file-parsing memory-safety flaw (CWE-125 Out-of-Bounds Read): the attack vector is LOCAL and requires user interaction (UI:R) - the victim must open a maliciously crafted CATPRODUCT file - so there is no network-exploitable, unauthenticated remote path despite the high numeric score. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. The signals are therefore consistent rather than conflicting: a high technical-impact bug (potential code execution) gated behind meaningful real-world friction (local access plus user action). Note one tension worth verifying: the vulnerability is an Out-of-Bounds READ (CWE-125) yet the description and CVSS claim arbitrary code execution with I:H/A:H - OOB reads most reliably yield crashes and information disclosure, and reaching full code execution from a pure read primitive typically requires chaining with other conditions, so the RCE outcome should be treated as a vendor-stated worst case rather than a demonstrated capability. Priority should be driven by whether the affected Autodesk product is deployed and how exposed users are to untrusted CATPRODUCT files.

An attacker emails or shares a maliciously crafted CATPRODUCT file (e.g., posing as a legitimate CAD assembly from a supplier or colleague) with an engineer who uses an affected Autodesk product. When the victim opens the file, the vulnerable shared component performs an out-of-bounds read while parsing it, allowing the attacker to crash the application, disclose sensitive in-process memory, or potentially execute code in the context of the current user. No public exploit code has been identified at time of analysis, so the scenario reflects the vendor-described capability rather than an observed in-the-wild attack.