Autodesk Shared Components CVE-2025-9454

Exploitation requires a victim to open or parse an attacker-supplied, maliciously crafted PRT file within a vulnerable Autodesk product that incorporates the affected shared components - this is the exact trigger condition. Limiting factors that reduce real-world risk: the attack is LOCAL only (AV:L), so it cannot be launched remotely over a network; it requires user interaction (UI:R), i.e. the user must actively open the malicious file; and code executes only in the privilege context of the current user running the application, with no scope change (S:U). There is no network-facing or unauthenticated-service exposure.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) is explicitly a LOCAL attack vector requiring user interaction - meaning an attacker cannot reach this over the network; a victim must be convinced to open a maliciously crafted PRT file. There is no EPSS score, no CISA KEV listing, and no public POC referenced in the supplied data, so all three exploitation-likelihood signals are either absent or negative. The high base score is driven entirely by the full C:H/I:H/A:H impact triad (arbitrary code execution in the current process), not by ease of exploitation. No SSVC decision data was provided. The combination of local vector plus required user interaction and no evidence of exploitation means real-world risk is moderate and heavily dependent on user behavior and file-handling discipline, despite the HIGH severity label. One note of caution: achieving reliable arbitrary code execution from an Out-of-Bounds Read (CWE-125) is typically harder than the vendor's 'can execute arbitrary code' phrasing implies - reads more often yield crashes or info disclosure - so verify the RCE claim against Autodesk advisory ADSK-SA-2025-0024.

An attacker crafts a malicious PRT (part) file and delivers it to a victim via email, a shared project repository, or a supplier/contractor file exchange. When the victim opens or imports the file in a vulnerable Autodesk product that uses the affected shared components, the out-of-bounds read is triggered, potentially leaking memory contents or executing code in the context of the user running the application. No public exploit code is identified at time of analysis, and exploitation requires the victim to actively open the file (UI:R).