Autodesk Revit CVE-2026-1288

Exploitation requires the target to have Autodesk Revit installed and to actively trigger the 'Convert RFA to FormIt' feature on a malicious RFA file - this specific conversion workflow is the vulnerable code path, not general RFA file opening. The CVSS local attack vector (AV:L) confirms the attack cannot be performed remotely without first placing the file on the victim's system; the UI:R metric confirms the victim must perform an explicit user action (initiating the conversion). No privileges are required to invoke the conversion feature (PR:N). Exploitation is constrained to a denial-of-service outcome (application crash only); no code execution or data exfiltration is indicated. Environments that restrict use of the FormIt conversion feature, or that do not open externally sourced RFA files directly in Revit, are not realistically exploitable.

The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) accurately reflects a moderate-severity, locally exploited denial-of-service issue. The local attack vector (AV:L) is the most significant risk-limiting factor: exploitation cannot be accomplished over a network directly; an attacker must first deliver a malicious RFA file to a target machine and then socially engineer the victim into performing the 'Convert RFA to FormIt' action (UI:R). Impact is strictly limited to application availability - there is no confidentiality or integrity dimension (C:N/I:N). No EPSS score was provided in the available data, so probability-based exploitation likelihood cannot be quantitatively assessed. The absence of a CISA KEV listing and the absence of any referenced proof-of-concept code suggest this is not currently being exploited at scale. Real-world risk is relatively low for organizations with standard email attachment and file-sharing controls; the primary concern is targeted spear-phishing scenarios where a trusted RFA file is weaponized. The availability of a vendor patch via Autodesk Access makes this straightforwardly remediable.

An attacker crafts a malformed RFA file designed to trigger a null pointer condition during FormIt conversion and delivers it to a Revit user via email, a shared project folder, or a collaboration platform under the guise of a standard Revit family asset. The victim opens the file in Autodesk Revit and invokes 'Convert RFA to FormIt,' causing the application to dereference a null pointer and crash immediately. No public proof-of-concept code has been identified, meaning successful crafting of the malicious RFA currently requires knowledge of the RFA file format internals.