Autodesk Fusion CVE-2026-102638

Exploitation requires the victim to import a maliciously crafted electronic library (.lbr) file into the Autodesk Fusion desktop application and then open the Library Manager, which renders the attacker-controlled HTML in the library's description field and triggers the stored XSS. Limiting factors: this is a local, file-delivery attack (AV:L) requiring user interaction (UI:R) - the attacker must get a specific crafted .lbr file onto the victim's machine and induce them to import and view it; it is not remotely triggerable without that user action. The affected window is Fusion builds from 2705.1.30 up to (but not including) 2706.1.14; versions at or above 2706.1.14 are fixed per the vendor advisory.

This is a genuine but conditional risk rather than a drop-everything emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 7.1 High) describes a local, low-complexity flaw that requires victim interaction: the attacker does not authenticate to the target (PR:N), but the malicious .lbr library file must be imported and then viewed in the Library Manager by the victim (AV:L + UI:R). The vuln.today decision label is 'this_week', which aligns with a serious-but-not-active-exploitation posture. There is no KEV listing and no EPSS score in the provided data, so widespread or automated exploitation is not indicated; exploitation would be targeted and social-engineering-dependent (delivering a weaponized library file to a Fusion user). No EPSS value was supplied, so probability-of-exploitation cannot be quantified from this data. The impact ceiling is high (C:H/I:H) because the advisory states the payload can read local files or execute arbitrary code in the process context, but A:N means no availability impact. Net: a real priority to patch within the vendor/triage-suggested window, but gated behind user interaction and a non-remote (local file) attack vector, so it is not a wormable, internet-facing threat.

An attacker crafts a Fusion electronic library (.lbr) file whose description field contains a malicious HTML/script payload and distributes it (e.g., via a shared component library, marketplace, or targeted email) to a Fusion user. When the victim imports the library and opens the Library Manager, the stored payload executes in the application context, enabling the attacker to read local files or run arbitrary code as the current user. No public exploit identified at time of analysis; exploitation depends on convincing the victim to import and view the crafted library (UI:R).