Autodesk Shared Components CVE-2025-10898
HIGHSeverity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing OOB write needs the victim to open a crafted MODEL file locally (AV:L/UI:R/PR:N); reliable memory corruption yields full C/I/A in-process (S:U).
Primary rating from Vendor (autodesk).
CVSS VectorVendor: autodesk
Lifecycle Timeline
2DescriptionCVE.org
AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
AnalysisAI
Out-of-bounds write in Autodesk Shared Components allows local attackers to execute arbitrary code in the context of the current process when a user opens a maliciously crafted MODEL file. Exploitation requires user interaction (UI:R) and no authentication (PR:N), and impact is limited to the privileges of the user running the affected Autodesk application (S:U). No public exploit code or active exploitation has been identified at time of analysis, though the CVSS base score is 7.8 (High).
Technical ContextAI
The vulnerability is an out-of-bounds write (CWE-787) in Autodesk Shared Components, a library used by multiple Autodesk products. When a maliciously crafted MODEL file is parsed, the parser writes data beyond the bounds of an allocated memory buffer, leading to memory corruption. This can result in a crash, data corruption, or arbitrary code execution within the process running the Autodesk application. The attack vector is local (AV:L) because the file must be opened locally, and it requires user interaction (UI:R). No privileges are needed (PR:N), and the scope is unchanged (S:U), meaning the impact is confined to the user's process. The CPE cpe:2.3:a:autodesk:shared_components:*:*:*:*:*:*:*:* indicates all versions of the shared components are potentially affected; exact affected products and versions should be confirmed via advisory ADSK-SA-2025-0024.
RemediationAI
Apply the updates specified in Autodesk security advisory ADSK-SA-2025-0024 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0024). The advisory provides the exact patched versions and instructions; no specific version numbers are included in the provided data. As the vulnerability requires opening a malicious MODEL file, avoid opening untrusted MODEL files from unknown sources. If immediate patching is not possible, restrict the opening of MODEL files to trusted sources, though this may impact legitimate workflows. Additionally, run Autodesk applications with least privilege to limit the impact of successful exploitation.
More in Shared Components
View allOut-of-bounds write in Autodesk shared components allows local attackers to execute arbitrary code, corrupt data, or cra
Out-of-bounds write in Autodesk products' CATPART file parser enables local attackers to achieve arbitrary code executio
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerabili
Heap-based buffer overflow in Autodesk Shared Components - the shared file-parsing libraries used by multiple Autodesk a
Uncontrolled recursion in Autodesk Shared Components' IFC file parser allows a denial-of-service condition across multip
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerabili
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today