What is the CVSS score of CVE-2026-1289?

CVE-2026-1289 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Autodesk Revit are affected by CVE-2026-1289?

A use-after-free vulnerability in Autodesk Revit's PDF parser (CVE-2026-1289) enables arbitrary code execution when users open maliciously crafted PDF files, exposing design and construction teams to…. A patch is available.

How to fix or mitigate CVE-2026-1289?

Within 24 hours, conduct a complete inventory of all Revit 2026 and 2027 installations to identify systems running versions prior to 2026.5.0 and 2027.2.0. Within 7 days, deploy vendor patch ADSK-SA-2026-0011 to all affected systems and verify successful installation. Within 30 days, confirm 100% patch coverage across the organization and document completion, with particular attention to offline or disconnected systems that may require staged updates.

Autodesk Revit CVE-2026-1289

EUVD-2026-54289 HIGH

Use After Free (CWE-416)

2026-08-06 psirt@autodesk.com

GHSA-37hm-v5j4-vc79

Use After Free Information Disclosure RCE Memory Corruption Revit

7.8

CVSS 3.1 · Vendor: autodesk

Severity by source

Vendor (autodesk) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector as exploitation requires file opened in Revit; PR:N since attacker needs no system privileges; UI:R for mandatory user file-open interaction; full C/I/A:H reflect UAF-enabled RCE potential.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (autodesk).

CVSS VectorVendor: autodesk

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 23:06 vuln.today

Patch available

Aug 06, 2026 - 23:03 EUVD

CVE Published

Aug 06, 2026 - 22:17 nvd

HIGH 7.8

DescriptionCVE.org

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process.

AnalysisAI

Use-After-Free in Autodesk Revit's PDF parser allows arbitrary code execution, sensitive data disclosure, or application crash when a user opens a maliciously crafted PDF file. Affected versions span Revit 2026 (prior to 2026.5.0) and Revit 2027 (prior to 2027.2.0), with full high-impact potential across confidentiality, integrity, and availability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available via advisory ADSK-SA-2026-0011.

Technical ContextAI

Autodesk Revit integrates a PDF parsing subsystem used to import or reference PDF documents within BIM (Building Information Modeling) workflows. The vulnerability is classified as CWE-416 (Use-After-Free): the parser fails to correctly manage the lifecycle of heap-allocated memory objects during PDF processing, freeing memory that is subsequently referenced by still-active pointers. Reuse or corruption of this freed memory region can redirect execution flow to attacker-controlled data, enabling arbitrary code execution within the Revit process context. Affected CPE-identified products are Autodesk Revit 2026 (versions 2026.0.0 through 2026.4.x) and Autodesk Revit 2027 (versions 2027.0.0 through 2027.1.x), as confirmed by EUVD-2026-54289 version ranges.

RemediationAI

The primary fix is to upgrade to Autodesk Revit 2026.5.0 or Autodesk Revit 2027.2.0, both of which address this vulnerability per vendor advisory ADSK-SA-2026-0011 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0011). Updates can be obtained through the Autodesk Access portal (https://www.autodesk.com/products/autodesk-access/overview). As a compensating control prior to patching, organizations should instruct Revit users to avoid opening PDF files received from untrusted or unverified sources; this directly breaks the social engineering delivery chain required for exploitation. Enforcing email attachment filtering or sandboxed document preview before opening in Revit can further reduce exposure. Note that restricting PDF opening entirely may impact legitimate workflows in AEC environments where PDF import is routine.