Autodesk Shared Components CVE-2025-9457

Exploitation requires a victim to open a maliciously crafted PRT (part) file within an affected Autodesk product that uses the vulnerable Autodesk Shared Components parser; the triggering action is the file-parsing operation itself. Per the CVSS vector (AV:L, UI:R, PR:N), no authentication or prior privileges are needed, but local access to the target and active user interaction (opening the malicious file) are mandatory - there is no remote or network-triggered path. The principal limiting factors are the need for social-engineering delivery of the file and the reliance on the user choosing to open untrusted PRT content, and impact is bounded to the privileges of the current process/user.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) describes a local, user-interaction-dependent file-parsing flaw: an attacker cannot reach it remotely over a network and must convince a victim to open a malicious PRT file in an affected Autodesk product. High confidentiality, integrity, and availability impact (C:H/I:H/A:H) is justified because successful exploitation yields arbitrary code execution in the context of the current process, consistent with the CWE-122 heap-based buffer overflow. No EPSS score, CISA KEV listing, or public proof-of-concept was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 7.8 'High' rating reflects impact potential, not demonstrated real-world weaponization. The dominant mitigating factor is the mandatory user interaction and local attack vector, which places this in the 'open-a-malicious-document' class typical of CAD/engineering file-format bugs rather than a wormable or internet-facing threat. Net: patch on a normal prioritized cycle, prioritizing users who routinely open third-party PRT files, but this is not a drop-everything issue absent any exploitation signal.

An attacker crafts a malicious PRT part file and delivers it to a victim via email, a shared project repository, or a supplier file exchange. When the engineer opens the file in a vulnerable Autodesk product, the shared parsing component triggers a heap memory corruption, allowing the attacker to execute arbitrary code with that user's privileges. The local vector and required user interaction (AV:L/UI:R) mean this depends on social engineering; no public exploit code was identified in the provided data.