Fusion Post Processor CVE-2026-107672

Exploitation requires a victim to open or process a maliciously crafted .stack.json file within the Autodesk Fusion Post Processor Utility extension (versions 5.0.1 up to, but not including, 5.0.2). The required file-open user interaction (UI:R) is the primary limiting factor: there is no remote, zero-click path - an attacker must get the hostile .stack.json in front of a user and have them load it. No authentication is required of the attacker (PR:N), and attack complexity is low (AC:L) once the file is opened. Commands run only in the context of the current user, so impact is bounded by that user's privileges.

This is a genuine but interaction-gated threat rather than a wormable, unauthenticated-on-its-own flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) scores network attack vector with no privileges, but the UI:R component is decisive: exploitation requires a victim to open or process a maliciously crafted .stack.json file in the Autodesk Fusion Post Processor Utility, so 'AV:N' here reflects file delivery over a network rather than a directly reachable network service. The vendor-assigned priority is 'this_week' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active exploitation or high predicted exploitation probability. No public exploit or PoC reference is present in the input. Net: treat this as a worth-patching, promptly-remediable issue (high impact if a user is socially engineered into opening a hostile file) but not a drop-everything emergency; the file-open requirement and absence of exploitation signals materially lower real-world urgency versus the raw 8.8.

An attacker crafts a malicious .stack.json file carrying a trusted-Markdown injection payload and delivers it to a victim (e.g., via a shared post-processor project, email, or download). When the victim opens or processes the file in the Autodesk Fusion Post Processor Utility, injected content executes arbitrary commands in the context of the current user. No public exploit code or PoC reference is identified in the available data; the low attack complexity (AC:L) means that once a user opens the crafted file, no additional specialized conditions are needed.