Autodesk Shared Components CVE-2025-9453

Exploitation requires a user to open or parse a maliciously crafted PRT (part) file within an affected Autodesk product that uses the vulnerable shared component; it cannot be triggered remotely or without this interaction (AV:L, UI:R, no network listener involved). Limiting factors: the attacker must first deliver the malicious file and socially engineer the victim into opening it, the resulting impact is confined to the current user's process context (S:U - no privilege boundary crossed), and reliable arbitrary code execution from an out-of-bounds READ is not guaranteed (crash or information disclosure are the more certain outcomes). No special non-default configuration is called out in the description - any installation able to open PRT files appears affected.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) is the dominant signal and it is internally consistent with the description: exploitation is LOCAL (AV:L) and requires user interaction (UI:R), meaning a victim must open or parse a maliciously crafted PRT file - this is a client-side file-parsing bug, not a remotely reachable network service. No EPSS score was provided, there is no CISA KEV listing, and no public POC was supplied in the intelligence, so all three exploitation-likelihood signals are either absent or negative. No SSVC decision data was provided. The high CVSS is driven entirely by local impact (C:H/I:H/A:H reflecting possible arbitrary code execution in the current user's process context), NOT by ease or likelihood of mass exploitation. In practice this means the flaw is a targeted/social-engineering risk (tricking a user into opening a weaponized file), not a wormable or internet-facing threat. Note that CWE-125 is an Out-of-Bounds READ, which most reliably yields crashes and information disclosure; the vendor's claim of 'arbitrary code execution' from a pure OOB read should be treated as a worst-case possibility rather than a guaranteed outcome - verify with Autodesk advisory ADSK-SA-2025-0024.

An attacker crafts a malicious PRT part file and delivers it to a victim via email, a shared project repository, or a download, relying on the fact that CAD/engineering users routinely open third-party model files. When the victim opens the file in an affected Autodesk product using the vulnerable shared component, the out-of-bounds read is triggered, crashing the application, leaking adjacent process memory, or potentially executing code as the current user. No public exploit code was identified in the provided intelligence; exploitation requires user interaction (UI:R) and local file handling.