Autodesk Shared Components CVE-2025-9456
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted SLDPRT file to victim
-
DeliveryVictim opens file in Autodesk product
-
ExploitTrigger out-of-bounds write in parser
-
ExecutionExecute arbitrary code as current user
-
ImpactCompromise engineering workstation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open an attacker-supplied, maliciously crafted SLDPRT (SolidWorks part) file within an affected Autodesk product that uses the vulnerable shared parsing component. There is no network-triggerable path: the CVSS vector is AV:L with UI:R, so the attack hinges entirely on social-engineering the victim into opening the file, and code executes only with the privileges of the current user/process (S:U, no privilege escalation). Limiting factors: the attacker needs no prior authentication (PR:N) but cannot act without victim interaction, and impact is bounded to the user context running the Autodesk application. |
| Impact | This is a credible but not emergency-tier vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a classic file-parsing memory-corruption bug: the attack vector is LOCAL and requires user interaction (UI:R), meaning a victim must be convinced to open a maliciously crafted SLDPRT file in an affected Autodesk product - this is not a remotely-triggerable, wormable network flaw despite the HIGH confidentiality/integrity/availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active exploitation or weaponization; the HIGH impact metrics reflect full code execution in the context of the current process rather than widespread exploitability. The signals are internally consistent (local vector + user interaction match a document-parsing bug), so there is no CVSS-versus-description conflict to flag. Net assessment: patch on a normal prioritized cadence, prioritizing workstations that routinely open third-party/untrusted CAD files, but this does not warrant out-of-band emergency response absent emerging exploitation evidence. |
| Exploit ScenarioDerived | An attacker crafts a malicious SLDPRT (SolidWorks part) file and delivers it to a target via email, a shared project repository, or a supplier/CAD-exchange channel. When an engineer opens the file in an affected Autodesk product, the memory-corruption flaw in the shared parsing component is triggered, allowing arbitrary code execution in the context of the running application. No public exploit code was identified in the provided data, and the local vector plus required user interaction (UI:R) mean the attack depends on social engineering to get the file opened. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Memory corruption in Autodesk Shared Components allows arbitrary code execution when a user opens a maliciously crafted SLDPRT file in an affected Autodesk product. The attack vector is local (AV:L) and requires user interaction (UI:R) but no authentication (PR:N), and code executes only with the privileges of the current process (S:U), limiting impact to the user context. No public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Apply the security update provided by Autodesk as referenced in advisory ADSK-SA-2025-0024 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0024). Since no exact patched version is provided in the available data, consult the advisory for the appropriate fix for each affected product. As compensating controls, restrict the import of untrusted SLDPRT files through application settings or group policy if such controls exist, and educate users to avoid opening files from unknown sources. Running Autodesk applications with least privilege can limit the impact of successful exploitation to the user's context. Note that disabling SLDPRT import may disrupt workflows that rely on SolidWorks interoperability.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an out-of-bounds write (CWE-787) in the shared component responsible for parsing SLDPRT files, which are SolidWorks part files. This shared library is used by multiple Autodesk products to import SolidWorks data, so any application incorporating the vulnerable component may be affected. The CPE cpe:2.3:a:autodesk:shared_components:*:*:*:*:*:*:*:* indicates that all versions of the shared component are potentially vulnerable. When parsing a crafted SLDPRT file, the component fails to validate input boundaries, leading to memory corruption that can be leveraged to execute arbitrary code in the context of the current process. The CVSS vector confirms low attack complexity and no required privileges, but with user interaction and no scope change.
Know when Shared Components gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened by a user so AV:L and UI:R; no auth needed (PR:N); code runs in-process with full memory corruption yielding C/I/A High and unchanged scope.
Primary rating from Vendor (autodesk).
CVSS VectorVendor: autodesk
DescriptionCVE.org
A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Executive ViewAI
Autodesk Shared Components, used across various Autodesk products, contains a high-severity memory corruption vulnerability that can allow arbitrary code execution when a user opens a malicious SLDPRT file. This unauthenticated attack requires user interaction and executes with the user's privileges, potentially leading to data theft or further compromise within the user's context, affecting any employee who uses affected Autodesk software. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, so leadership should prioritize interim mitigations and user awareness to reduce risk.
Interim mitigations include user awareness training, blocking SLDPRT files from untrusted sources, application whitelisting, endpoint detection and response monitoring, and enforcing least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Shared Components
View allHeap-based buffer overflow in Autodesk Shared Components - the shared file-parsing libraries used by multiple Autodesk a
Out-of-bounds write in Autodesk Shared Components allows local attackers to execute arbitrary code in the context of the
Memory corruption in the Autodesk Shared Components parser that handles CATPART files lets an attacker execute arbitrary
Out-of-bounds write in Autodesk shared components allows local attackers to execute arbitrary code, corrupt data, or cra
Out-of-bounds write in Autodesk products' CATPART file parser enables local attackers to achieve arbitrary code executio
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerabili
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerabili
An out-of-bounds read in Autodesk Shared Components can be triggered when a user opens or imports a maliciously crafted
An out-of-bounds read in Autodesk shared components lets an attacker crash an affected Autodesk application, read memory
Memory corruption in Autodesk Shared Components allows an attacker to execute arbitrary code in the context of the curre
Parsing a maliciously crafted CATPRODUCT (CATIA assembly) file in Autodesk products that rely on the affected shared com
Out-of-bounds read in Autodesk Shared Components allows local attackers to cause a crash, read sensitive memory, or pote
GitHub PoC
Exploit-DB