Autodesk Shared Components CVE-2026-14255

The victim must actively open a specially crafted IFC file using an affected Autodesk product that invokes the vulnerable shared component parser - this user interaction (UI:R) is a hard prerequisite. The attacker requires no authentication or elevated privileges (PR:N) but must successfully deliver the malicious file to the target and socially engineer the file open action, typically via phishing, supply-chain file poisoning, or shared project repositories. Impact is strictly limited to application availability (A:H, C:N, I:N): no code execution, no data exfiltration, and no system-level persistence are achievable through this vulnerability. Organizations not handling IFC files from external sources face negligible residual risk.

The CVSS 5.5 Medium score is consistent with the DoS-only impact profile: the vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H correctly reflects that exploitation requires the victim to open a file locally, with no confidentiality or integrity impact. The wildcard CPE version range (*) means the precise affected version set is not bounded in available data, which is a data gap - administrators should consult the vendor advisory to determine which product versions are vulnerable. No EPSS score was provided; no CISA KEV listing and no POC are present, placing real-world exploitation risk as low at this time. The 'shared components' framing elevates the breadth of exposure - a single library flaw potentially affects the entire Autodesk product portfolio - but the DoS-only outcome and mandatory user interaction substantially limit actionable risk. Priority should be moderate for organizations whose users routinely open IFC files received from external or untrusted sources.

An attacker crafts a malicious IFC file containing deeply nested or recursively structured geometry or property data and delivers it to a target via email, a shared project folder, or a collaboration platform commonly used in AEC workflows. The victim opens the file in an affected Autodesk product, the shared IFC parser enters uncontrolled recursion, exhausts the call stack, and the application terminates - interrupting the user's session and potentially causing unsaved work loss. No public exploit code exists at time of analysis, but IFC file structure is well-documented and construction of a triggering file by a motivated actor is plausible.