Autodesk Shared Components CVE-2025-10889

Exploitation requires a victim to open or import a maliciously crafted CATPART file into an affected Autodesk product that uses the vulnerable shared-components parser (UI:R). No authentication or elevated privileges are needed (PR:N), but the attack is local/file-based (AV:L): the attacker cannot trigger it remotely without first getting the malicious file onto the victim's system and having the user open it. Limiting factors are the mandatory user interaction (social engineering to deliver and open the file) and the requirement that the target actually has an affected Autodesk product capable of parsing CATPART files installed; code executes only with the privileges of the current user, not elevated.

The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 High) describes a classic file-format parsing memory-corruption bug: exploitation is local and requires the victim to open a maliciously crafted CATPART file (UI:R), but needs no prior authentication or privileges (PR:N). This is not a remotely reachable, wormable flaw - it is a client-side, user-interaction-gated RCE typical of CAD/engineering software. No EPSS score, CISA KEV entry, POC, or SSVC decision data was provided, so exploitation status is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS combined with the UI:R requirement suggests this is a real but not urgent priority: dangerous where malicious design files circulate (supply chains, contractor file exchange, downloaded models), yet reliant on social engineering to land. The 7.8 score is credible and well-matched to the vector; there is no CVSS-vs-description conflict. Note the input's AV:L is correct despite CATPART files often arriving over a network - the trigger requires local file parsing, so AV:L (not AV:N) is the honest choice.

An attacker crafts a malicious CATPART (CATIA part) file and delivers it to a target engineer via email, a shared model repository, a supplier data exchange, or a compromised download. When the victim opens or imports the file into an affected Autodesk product using the vulnerable shared components parser, the memory corruption triggers and arbitrary code executes in the context of the current user. No public exploit code is identified at time of analysis.