Autodesk Shared Components CVE-2025-14593

Exploitation requires the victim to open an attacker-supplied, maliciously crafted CATPART (CATIA part) file inside an affected Autodesk product that uses the vulnerable shared-components parser; the flaw is in the CATPART parsing path specifically. Key limiting factors: the attack vector is local (AV:L) and requires user interaction (UI:R) - there is no network-triggerable or unauthenticated-remote path, so the attacker must rely on social engineering or a supply-chain/file-sharing delivery channel. No special application privileges are needed (PR:N), and impact is confined to the current process context (S:U), meaning execution occurs at the privilege level of the user running the Autodesk product.

This is a legitimate but moderate-urgency priority rather than a mass-exploitation threat. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) shows the defining constraint: AV:L combined with UI:R means this is NOT remotely triggerable over a network - exploitation requires a victim to locally open a maliciously crafted CATPART file in a vulnerable Autodesk product. PR:N indicates no authentication is needed against the application itself, and the high C/I/A impacts reflect the description's claim of possible arbitrary code execution. No EPSS score, SSVC decision, KEV listing, or POC reference was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk therefore hinges entirely on social engineering (delivering a weaponized file to an engineer who opens it). Note a mild signal tension: the 'RCE' tag and description allow code execution, but CWE-125 (Out-of-Bounds Read) more naturally yields crashes or information disclosure than reliable code execution - weaponization to full RCE is plausible but not confirmed and would typically require additional memory-corruption primitives.

An attacker emails or shares a trojanized .CATPART CAD model with an engineer, or seeds it on a model-sharing/supplier portal. When the victim opens the file in an affected Autodesk product, the shared-components parser performs an out-of-bounds read, leaking memory contents or crashing the process and potentially allowing code execution in the user's context. No public exploit code is identified at time of analysis, and the AV:L/UI:R vector means the attack only succeeds if the target opens the crafted file.