Autodesk Shared Components CVE-2025-10884

Exploitation requires a user to open a maliciously crafted CATPART (CATIA V5 part) file in an affected Autodesk product that embeds the vulnerable shared-components parsing library; the out-of-bounds write is triggered during file parsing. Limiting factors: the vector is local (AV:L) with mandatory user interaction (UI:R) - there is no remote or unauthenticated network exploitation path, so the attacker must socially engineer the victim into opening an untrusted CATPART file. Code execution occurs only in the context of the current user process (S:U), bounding impact to that user's privileges. Risk is concentrated in workflows that routinely ingest externally-sourced CAD files (supplier exchanges, model-sharing portals); environments that do not open untrusted CATPART files are effectively unexposed.

This is a locally-exploitable, file-parsing memory-corruption flaw whose signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) correctly describes a client-side bug: there is no network vector - exploitation requires a victim to open an attacker-supplied CATPART file (AV:L + UI:R), so this is NOT a remotely-reachable server flaw despite the 'RCE' tag. No EPSS score was supplied, so quantitative exploitation probability cannot be stated. The vulnerability is NOT in CISA KEV and no public exploit code was provided in the intelligence, yielding 'no public exploit identified at time of analysis.' The combined picture is a genuine high-impact RCE primitive (OOB write, CWE-787, full C/I/A loss in the current process) gated behind meaningful user interaction and local delivery - a real priority for environments that routinely open externally-sourced CAD files, but materially lower urgency than a network-exploitable or actively-exploited bug. The main uncertainty is scope of affected products: the CPE lists only 'autodesk:shared_components' with a wildcard version and the advisory enumerates specific product versions not reproduced here - verify exact affected Autodesk products and fixed builds against advisory ADSK-SA-2025-0024.

An attacker emails or shares a maliciously crafted CATPART file disguised as a legitimate CAD part, or plants it on a model-sharing/supplier portal. When an engineer opens it in an affected Autodesk product, the flawed parser performs an out-of-bounds write, allowing the attacker to crash the application, corrupt data, or execute arbitrary code in the context of the current user. No public proof-of-concept was identified; the local attack vector and required user interaction (AV:L/UI:R) mean exploitation depends on social engineering the victim into opening the file.