Autodesk Revit CVE-2026-1289

Exploitation requires a user to actively open a maliciously crafted PDF file using an affected version of Autodesk Revit (2026.0.0-2026.4.x or 2027.0.0-2027.1.x). The CVSS vector AV:L/UI:R confirms the attack is local to the machine running Revit and requires explicit user interaction - the victim must deliberately open the file. PR:N indicates no attacker-controlled privileges on the target system are needed; the attacker only needs to deliver the file. There is no evidence the vulnerability triggers on passive file indexing or thumbnail preview; active parsing via PDF import or open is the confirmed trigger path. Exploitation is limited to the current process context (S:U), so privilege escalation beyond the running Revit user is not inherent to this CVE.

The CVSS 3.1 score of 7.8 (High) is justified by the full C:H/I:H/A:H triad, though the local attack vector (AV:L) and required user interaction (UI:R) meaningfully constrain real-world risk. Exploitation requires a target user to actively open a weaponized PDF within Revit, making this a social engineering-dependent attack path rather than a remotely triggerable, zero-touch vulnerability. There is no CISA KEV listing and no publicly known proof-of-concept code, which reduces urgency compared to similarly scored issues with confirmed active exploitation. EPSS data was not available in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. The combination of AV:L, UI:R, and no KEV/POC suggests this is a genuine priority for organizations in architecture, engineering, and construction sectors relying on Revit, but not an emergency requiring out-of-band emergency response - patching within a normal cycle is appropriate unless the environment has elevated threat exposure.

An attacker crafts a malicious PDF file designed to trigger the Use-After-Free condition in Revit's parser and delivers it to a target architect or engineer via phishing email, a compromised file-sharing platform, or a fraudulent project collaboration request. When the recipient opens the PDF within Autodesk Revit, the parser corrupts heap memory and the attacker achieves code execution within the Revit process, potentially exfiltrating project files, credentials stored in memory, or establishing a foothold on the workstation. No public proof-of-concept exists at time of analysis, meaning successful exploitation currently requires independent vulnerability weaponization.