Autodesk AutoCAD CVE-2026-16465

Exploitation requires a local user to actively open a malicious DWG or DXF file in one of the affected Autodesk products (AutoCAD, AutoCAD LT, or DWG TrueView version 2027.0.0). The CVSS vector confirms AV:L (local file access) and UI:R (active user interaction - the victim must open the file), meaning automated or remote exploitation without user involvement is not possible. PR:N indicates the attacker requires no system-level privileges themselves; the exploit is delivered entirely through the malicious file content. Exploitation is limited to users running affected 2027.0.0 builds; users on 2027.1.0 or later are not affected. The confidentiality impact depends on what sensitive data happens to reside in adjacent memory at the time of the read - this is non-deterministic and may vary across environments and sessions.

Despite a CVSS base score of 7.1, multiple converging signals indicate low real-world exploitation priority. The CVSS vector (AV:L/UI:R) confirms exploitation is local and requires the victim to actively open a malicious file - eliminating remote, zero-click, or mass-automated exploitation paths. EPSS at 0.12% (2nd percentile) aligns with this, predicting essentially no near-term opportunistic exploitation. SSVC independently scores Exploitation as 'none,' Automatable as 'no,' and Technical Impact as 'partial,' reinforcing a low-urgency posture for most defenders. The vulnerability is not listed in CISA KEV and no public exploit code has been identified. The primary real-world risk vector is spear-phishing or supply-chain file delivery targeting engineers and designers who routinely open DWG/DXF files from external collaborators - a workflow-specific social engineering risk. The high C and A CVSS sub-scores are accurate for a successful exploitation but the prerequisite of local file execution substantially narrows the realistic threat population.

An attacker targeting an architectural firm crafts a malicious DWG file that encodes a specially structured geometric entity with a manipulated record length, causing the AutoCAD parser to read beyond the allocated buffer during file open. The file is delivered via email as a project collaboration asset; when the engineer opens it in AutoCAD 2027.0.0, the OOB read either crashes AutoCAD (denying access to active project work) or leaks adjacent heap memory that could contain credentials, file paths, or other in-process sensitive data. No public proof-of-concept has been identified at time of analysis.