Autodesk Shared Components CVE-2025-9459

Exploitation requires a user to open or import an attacker-supplied, maliciously crafted SLDPRT file within an affected Autodesk product built on the vulnerable shared components - the flaw is in the SLDPRT parsing path, not a network-facing service. Limiting factors that reduce real-world risk: the attack vector is Local (AV:L), mandatory user interaction is required (UI:R) to open the file, and the attacker needs a successful delivery/social-engineering step; there is no remote, unauthenticated, no-interaction trigger. No special non-default configuration is indicated - any installation that can open SLDPRT files is potentially affected.

This is a genuine but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 High) tells a coherent story: exploitation is NOT remote-over-the-network despite PR:N - the Local attack vector plus UI:R means an attacker cannot reach the flaw unprovoked; a user must be convinced to open a maliciously crafted SLDPRT file in an affected Autodesk product. The impact triad is maximal (C:H/I:H/A:H) because the vendor describes outcomes ranging from crash and sensitive-data disclosure up to arbitrary code execution in the current process, which is consistent with a CWE-125 Out-of-Bounds Read that is corruptible into control-flow. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there are no signals of active or imminent mass exploitation - the realistic threat model is targeted social-engineering/file-delivery rather than worm-like spread. No SSVC decision data was supplied. Net: a legitimate High that warrants patching on a normal cycle, but the local vector plus mandatory user interaction materially caps real-world risk versus a true network-reachable RCE. Note the apparent tension to verify: PR:N (unauthenticated) combined with AV:L simply reflects a file-parsing bug where no login is needed but local file-open is - this is expected for client-side CAD parsers, not a contradiction.

An attacker crafts a malicious SLDPRT file and delivers it to a victim via email, a shared project repository, or a supplier file exchange. When the victim opens the file in a vulnerable Autodesk product that uses the affected shared components, the out-of-bounds read is triggered, potentially leaking process memory or executing attacker code in the user's context. No public exploit code was identified at time of analysis, so weaponization would require independent development.