What is the CVSS score of CVE-2026-16463?

CVE-2026-16463 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Autodesk AutoCAD are affected by CVE-2026-16463?

Autodesk AutoCAD, AutoCAD LT, and DWG TrueView are vulnerable to arbitrary code execution when users open maliciously crafted DXF drawing files, potentially exposing design intellectual property and…. A patch is available.

How to fix or mitigate CVE-2026-16463?

Within 24 hours, notify all AutoCAD users to avoid opening DXF files from untrusted sources and restrict file uploads through email and collaboration platforms. Within 7 days, test the available vendor patch in a pilot environment and begin staged deployment, prioritizing engineering and design departments. Within 30 days, complete full deployment across all AutoCAD, AutoCAD LT, and DWG TrueView installations and verify patch compliance through asset management systems.

Autodesk AutoCAD CVE-2026-16463

EUVD-2026-50373 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-29 autodesk

GHSA-6j5h-wf67-fv42

Information Disclosure Buffer Overflow Heap Overflow RCE Autocad Autocad Lt Dwg Trueview

7.8

CVSS 3.1 · Vendor: autodesk

Severity by source

Vendor (autodesk) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File must be opened locally by a user (AV:L, UI:R) with no prior privileges (PR:N); memory corruption yields full code execution, so C/I/A all High.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (autodesk).

CVSS VectorVendor: autodesk

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 15:51 vuln.today

CVE Published

Jul 29, 2026 - 15:22 cve.org

HIGH 7.8

DescriptionCVE.org

A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

AnalysisAI

Arbitrary code execution in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView occurs when a user opens a maliciously crafted DXF file, triggering a heap-based buffer overflow (CWE-122) in the file parser. A local attacker who convinces a victim to open the file can crash the application, read sensitive in-process memory, or run code in the context of the current user. There is no public exploit identified at time of analysis, and the file-format vector plus required user interaction places this in the classic 'malicious drawing file' threat model rather than remote mass exploitation.

Technical ContextAI

The affected technology is Autodesk's DWG/DXF drawing-file parsing engine shared across AutoCAD, AutoCAD LT, and the free DWG TrueView viewer (per the CPE strings cpe:2.3:a:autodesk:autocad, :autocad_lt, and :dwg_trueview). DXF (Drawing Exchange Format) is an ASCII/binary CAD interchange format whose records are read into heap-allocated structures during import. CWE-122 (Heap-Based Buffer Overflow) indicates the parser writes attacker-controlled data past the bounds of a heap allocation - typically from a length or count field in the DXF stream that is trusted without validation - allowing adjacent heap metadata or object pointers to be corrupted, which is the root cause enabling both information disclosure and code execution.

RemediationAI

Patch available per vendor advisory: apply the updates published in Autodesk security advisory ADSK-SA-2026-0009 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0009), deploying them through Autodesk Access for AutoCAD and AutoCAD LT (https://www.autodesk.com/products/autodesk-access/overview) and by updating DWG TrueView to the fixed build (https://www.autodesk.com/products/dwg-trueview/overview); the input did not include an exact fix version, so confirm the specific patched build in the advisory. Until patched, treat DXF/DWG files from untrusted or external sources as hostile: do not open files received by email or download without validation, restrict opening of externally-sourced drawings to isolated or sandboxed workstations, and preview questionable files in an environment where a crash or code execution cannot reach sensitive data - the trade-off being reduced convenience in normal CAD collaboration workflows where external file exchange is routine.