What is the CVSS score of CVE-2026-1288?

CVE-2026-1288 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-1288?

Yes, a patch is available for CVE-2026-1288. Update the affected software to the latest version immediately.

Autodesk Revit CVE-2026-1288

MEDIUM

NULL Pointer Dereference (CWE-476)

2026-06-17 autodesk

Denial Of Service Null Pointer Dereference Revit Autodesk

5.5

CVSS 3.1 · Vendor: autodesk

Severity by source

Vendor (autodesk) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local file-based trigger (AV:L), user must initiate conversion (UI:R), no privileges needed, crash-only impact with no C or I.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (autodesk).

CVSS VectorVendor: autodesk

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 16:57 vuln.today

DescriptionCVE.org

A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.

AnalysisAI

NULL pointer dereference in Autodesk Revit's 'Convert RFA to FormIt' feature causes the application to crash when processing a specially crafted RFA file, resulting in a denial-of-service condition. All tracked versions of Autodesk Revit are affected per CPE data, with the attack requiring local file access and deliberate user interaction to trigger the vulnerable conversion workflow. No public exploit code and no CISA KEV listing exist at time of analysis; a vendor-released patch is available through Autodesk Access.

Technical ContextAI

Autodesk Revit (cpe:2.3:a:autodesk:revit:*:*:*:*:*:*:*:*) includes a built-in conversion utility that transforms Revit Family (RFA) files into Autodesk FormIt geometry. The conversion pipeline contains a CWE-476 (NULL Pointer Dereference) flaw: during parsing or processing of RFA content, a pointer is dereferenced without first being validated for a NULL condition. When a maliciously structured RFA file is fed into this path, the runtime dereferences a null pointer, triggering an access violation and crashing the host Revit process. CWE-476 defects of this class typically arise from missing error-path checks after object allocation or resource lookup - if the expected object is absent or the allocation fails, subsequent use of the uninitialized pointer causes the fault. Because the crash occurs inside the Revit application process, the scope is unchanged (S:U) and no memory corruption primitive useful for code execution has been identified in available data.

RemediationAI

Apply the vendor-released patch for Autodesk Revit through the Autodesk Access client available at https://www.autodesk.com/products/autodesk-access/overview. The exact patched version number is not specified in available data - check the Autodesk security advisory ADSK-SA-2026-0007 at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0007 for the specific fixed build. As a compensating control where patching is not immediately possible, organizations should instruct users not to use the 'Convert RFA to FormIt' feature on RFA files received from untrusted or unverified external sources, since the conversion step is the precise trigger for the vulnerability. Blocking or quarantining inbound RFA files at email gateways and collaboration platforms reduces the attack surface further, with the trade-off that legitimate architectural family files from external partners would require manual review before processing.