What is the CVSS score of CVE-2026-16465?

CVE-2026-16465 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Autodesk AutoCAD are affected by CVE-2026-16465?

Autodesk AutoCAD 2027.0.0, AutoCAD LT, and DWG TrueView users face memory disclosure and application crash risks when handling maliciously crafted design files.. A patch is available.

How to fix or mitigate CVE-2026-16465?

Within 24 hours, identify all staff using AutoCAD 2027.0.0, AutoCAD LT 2027.0.0, or DWG TrueView 2027.0.0 and alert them to verify file sources before opening DWG or DXF files and report any application crashes or unusual behavior. Over the next 7 days, obtain and validate the vendor patch from ADSK-SA-2026-0009 in a non-production environment to ensure compatibility with deployed plugins and workflows. Complete patch deployment across all affected systems by day 30, prioritizing systems in design and engineering departments that process external CAD files.

Autodesk AutoCAD CVE-2026-16465

EUVD-2026-50374 HIGH

Out-of-bounds Read (CWE-125)

2026-07-29 autodesk

GHSA-6vgj-fv64-hcvj

Buffer Overflow Information Disclosure Autocad Autocad Lt Dwg Trueview

7.1

CVSS 3.1 · NVD

Severity by source

Vendor (autodesk) PRIMARY

MEDIUM

qualitative

NVD

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

vuln.today AI

7.1 HIGH

Local file-open required (AV:L), attacker needs no system privileges (PR:N), victim must interact (UI:R); OOB read yields memory disclosure (C:H) and crash (A:H) but no write primitive (I:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (autodesk).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 01:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 01:52 vuln.today

cvss_changed

Severity Changed

Aug 11, 2026 - 01:52 NVD

MEDIUM HIGH

CVSS changed

Aug 11, 2026 - 01:52 NVD

6.1 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jul 29, 2026 - 15:53 vuln.today

CVE Published

Jul 29, 2026 - 15:22 cve.org

MEDIUM 6.1

DescriptionNVD

A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.

AnalysisAI

Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView 2027.0.0 exposes users to application crashes and sensitive memory disclosure when parsing maliciously crafted DWG or DXF files. Exploitation requires a local user to open a weaponized file, making social engineering the primary delivery mechanism targeting CAD operators in AEC and manufacturing environments. No active exploitation has been confirmed (not in CISA KEV), EPSS sits at a negligible 0.12% (2nd percentile), and a vendor patch is available via ADSK-SA-2026-0009.

Technical ContextAI

CWE-125 (Out-of-Bounds Read) occurs within the DWG and DXF file-format parsers embedded in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView. DWG is Autodesk's proprietary binary CAD format, and DXF (Drawing Exchange Format) is its text-based interchange counterpart - both are complex, structured file formats whose parsers must interpret variable-length records, entity tables, and geometric data. An improperly validated read operation allows parsing logic to access memory beyond an allocated buffer boundary, producing two distinct outcomes: an access violation that crashes the host process (availability impact) or the surfacing of adjacent heap or stack memory contents to an attacker-observable channel such as an error log or crafted response (confidentiality impact). The CPE scope covers all 2027 builds prior to 2027.1.0 of cpe:2.3:a:autodesk:autocad, cpe:2.3:a:autodesk:autocad_lt, and cpe:2.3:a:autodesk:dwg_trueview.

RemediationAI

The primary fix is to update all affected products to version 2027.1.0 or later via the Autodesk Access desktop application (https://www.autodesk.com/products/autodesk-access/overview) or by downloading directly from product pages at https://www.autodesk.com/products/dwg-trueview/overview. Until patching is complete, organizations should train users to treat unsolicited or externally sourced DWG and DXF files as untrusted and open them only in sandboxed or isolated environments - for instance, using DWG TrueView on a non-networked or read-only VM rather than a workstation with access to sensitive data, reducing the risk of memory disclosure reaching the attacker. Disabling automatic preview or thumbnail generation for DWG/DXF files in Windows Explorer can reduce incidental parsing exposure, though the trade-off is reduced usability for design review workflows. The vendor advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0009 is the authoritative source for patch confirmation.