What is the CVSS score of CVE-2026-17550?

CVE-2026-17550 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-17550?

Yes, a patch is available for CVE-2026-17550. Update the affected software to the latest version immediately.

Autodesk AutoCAD CVE-2026-17550

EUVD-2026-50375 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-29 autodesk

GHSA-fpp4-v32m-5wmg

Buffer Overflow Information Disclosure Autocad Autocad Lt Dwg Trueview

5.5

CVSS 3.1 · Vendor: autodesk

Severity by source

Vendor (autodesk) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

6.1 MEDIUM

C:L added over official C:N to reflect description-stated memory disclosure potential from out-of-bounds read; all other metrics align with local file-open attack requiring user interaction.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (autodesk).

CVSS VectorVendor: autodesk

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 15:51 vuln.today

CVE Published

Jul 29, 2026 - 15:23 cve.org

MEDIUM 5.5

DescriptionCVE.org

A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information.

AnalysisAI

Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView is triggered when parsing maliciously crafted DWG or DXF files, potentially resulting in application crash or memory disclosure. The attack requires a user to open a weaponized design file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Autodesk advisory ADSK-SA-2026-0009.

Technical ContextAI

The vulnerability class is CWE-125 (Out-of-Bounds Read), occurring within the DWG and DXF file format parsing subsystem shared across three Autodesk products: AutoCAD (cpe:2.3:a:autodesk:autocad), AutoCAD LT (cpe:2.3:a:autodesk:autocad_lt), and DWG TrueView (cpe:2.3:a:autodesk:dwg_trueview). DWG and DXF are binary and ASCII-based CAD exchange formats respectively; their parsers must handle complex, deeply nested geometric and metadata structures, creating a large attack surface for memory-safety bugs. An out-of-bounds read occurs when a parser accesses memory beyond an allocated buffer boundary, which in this context can be induced by supplying malformed dimension, entity, or header block values in the crafted file. This type of flaw can both destabilize the application and leak heap or stack memory contents depending on where the read lands.

RemediationAI

The primary remediation is to apply the vendor-released patch via the Autodesk Access updater available at https://www.autodesk.com/products/autodesk-access/overview, which distributes security updates for AutoCAD and AutoCAD LT. DWG TrueView users should update through https://www.autodesk.com/products/dwg-trueview/overview. The full advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0009 provides patch version confirmation. As a compensating control where immediate patching is not feasible, restrict the opening of DWG and DXF files received from untrusted external sources; enforce file-origin policies via email gateway filtering to quarantine .dwg and .dxf attachments pending review. Note that this control reduces attack surface but does not eliminate risk from files received through other channels (USB, shared drives, collaborative platforms). No version-level downgrade path is recommended as a workaround.