Autodesk Shared Components CVE-2025-9452
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted SLDPRT file to victim
-
ExploitUser opens file in Autodesk product
-
ExecutionTrigger out-of-bounds write in Shared Components parser
-
ImpactExecute arbitrary code in process context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-supplied, maliciously crafted SLDPRT file in an affected Autodesk product that uses the vulnerable Shared Components parser; the flaw is triggered during file parsing. Limiting factors per the CVSS vector: the attack vector is local (AV:L) and mandatory user interaction (UI:R) is required - the attacker cannot trigger it remotely or without the victim opening the file. No attacker privileges or authentication are needed (PR:N), and code executes only in the context of the current (user-privileged) process (S:U), so no automatic privilege escalation occurs. |
| Impact | The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a classic client-side file-parsing memory corruption: a local attack vector requiring the victim to open a maliciously crafted SLDPRT file, with no attacker privileges but mandatory user interaction. These signals are internally consistent - this is not a remotely reachable network service flaw despite the HIGH score. No EPSS score was supplied, and the vulnerability is NOT listed in CISA KEV, and no public POC is referenced, so there is no evidence of active or at-scale exploitation. The high CVSS is driven by full C/I/A impact (arbitrary code execution in the current process), but the AV:L/UI:R gating means real-world exploitation depends on social engineering (tricking a user into opening a crafted CAD file). Net assessment: a genuine high-severity code-execution bug worth patching in CAD/engineering environments, but weighted toward targeted/social-engineering use rather than mass exploitation given the local vector and user-interaction requirement. Missing data: EPSS, POC status, and specific affected Autodesk product versions are not provided in the input. |
| Exploit ScenarioDerived | An attacker crafts a malicious SLDPRT (SolidWorks part) file and delivers it to a victim via email, a shared drawing exchange, or a supply-chain/project file. When an engineer opens the file in an affected Autodesk product, the Shared Components parser triggers an out-of-bounds write (CWE-787), allowing the attacker to execute arbitrary code in the context of the running application. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Memory corruption in the SLDPRT file parser of Autodesk Shared Components allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted file. All versions of the Shared Components library (CPE cpe:2.3:a:autodesk:shared_components:*:*:*:*:*:*:*:*) are affected, and any Autodesk desktop product that relies on this component to import SolidWorks SLDPRT parts inherits the exposure. Exploitation requires the victim to open an attacker-supplied SLDPRT file (AV:L, UI:R, PR:N), and there is no public exploit identified at time of analysis; no CISA KEV entry was provided, and impact is confined to the user-privileged process, with no automatic privilege escalation.
RemediationAI
Apply the fix identified in Autodesk security advisory ADSK-SA-2025-0024 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0024), which is listed in the references alongside the Autodesk Access product page (https://www.autodesk.com/products/autodesk-access/overview); no patch version is specified in the available data, so consult the advisory for the exact updated Shared Components build and update through Autodesk Access or the vendor's managed updater. Until updates are deployed, the highest-value compensating control is to prevent untrusted SLDPRT files from reaching users: block SLDPRT attachments at the mail and web gateways and enforce Mark-of-the-Web/Protected View-style controls, accepting the trade-off that legitimate supplier-supplied CAD parts may be delayed or quarantined. Running Autodesk applications as a non-administrative user limits damage because execution is confined to the current process and no privilege escalation is achieved, though it does not prevent the memory corruption itself. Additional hardening includes disabling automatic preview/thumbnail generation and shell extension parsing of SLDPRT files (which can trigger the parser without an explicit open), an approach that slightly degrades file-browsing convenience, and monitoring for unexpected crashes or child-process creation spawned by Autodesk applications as an indicator of exploitation attempts.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an out-of-bounds write (CWE-787) in the Shared Components library used across Autodesk products to import and translate third-party CAD formats, here the SolidWorks SLDPRT format. When parsing a malformed SLDPRT structure, the code writes beyond the bounds of an allocated buffer, corrupting adjacent memory; because the parser runs inside the application process, a controlled corruption can be shaped into arbitrary code execution with the privileges of the user who opened the file. This is a classic client-side file-format parsing weakness: the CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (base 7.8 HIGH) confirms a local attack vector with no authentication required but mandatory user interaction, and scope unchanged, meaning the attacker gains code execution as the invoking user rather than escalating to system level. The product-specific CPE points to the shared parsing component rather than a single application, so the vulnerable code ships inside many Autodesk installs.
Know when Shared Components gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user so AV:L and UI:R; no privileges needed (PR:N); arbitrary code execution yields full C/I/A within the unchanged process scope.
Primary rating from Vendor (autodesk).
CVSS VectorVendor: autodesk
DescriptionCVE.org
A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Executive ViewAI
A memory-corruption flaw in Autodesk Shared Components - the library used by many Autodesk desktop products to import SolidWorks SLDPRT files - lets an attacker run arbitrary code with the victim user's privileges if that user opens a maliciously crafted part file. Because the vulnerable library is shared across the Autodesk desktop portfolio, any engineering workstation that imports SLDPRT content inherits the exposure, putting design data, credentials, and internal network access at risk. No vendor patch or public exploit is available today, so leadership should treat this as a manageable but unmitigated risk requiring temporary process controls until Autodesk ships a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: block and quarantine .SLDPRT files at email, web, and file-transfer gateways; prohibit opening SLDPRT files from untrusted or external sources; enforce least-privilege user accounts so code execution is confined to the user context; sandbox or detonate untrusted design files before opening; apply application allowlisting on engineering workstations; enable EDR monitoring for suspicious child processes spawned by Autodesk applications; and maintain user awareness and reporting procedures for suspicious design files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Shared Components
View allHeap-based buffer overflow in Autodesk Shared Components - the shared file-parsing libraries used by multiple Autodesk a
Out-of-bounds write in Autodesk Shared Components allows local attackers to execute arbitrary code in the context of the
Memory corruption in the Autodesk Shared Components parser that handles CATPART files lets an attacker execute arbitrary
Out-of-bounds write in Autodesk shared components allows local attackers to execute arbitrary code, corrupt data, or cra
Out-of-bounds write in Autodesk products' CATPART file parser enables local attackers to achieve arbitrary code executio
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerabili
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerabili
An out-of-bounds read in Autodesk Shared Components can be triggered when a user opens or imports a maliciously crafted
An out-of-bounds read in Autodesk shared components lets an attacker crash an affected Autodesk application, read memory
Memory corruption in Autodesk Shared Components allows an attacker to execute arbitrary code in the context of the curre
Memory corruption in Autodesk Shared Components allows arbitrary code execution when a user opens a maliciously crafted
Parsing a maliciously crafted CATPRODUCT (CATIA assembly) file in Autodesk products that rely on the affected shared com
GitHub PoC
Exploit-DB