EUVD-2026-54292
GHSA-ww8h-hg5f-w94j
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
File-borne local attack requiring user import action; availability-only impact matches DoS-only description; C:N retained pending vendor clarification of info-disclosure tag.
Primary rating from Vendor (autodesk).
CVSS VectorVendor: autodesk
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service
AnalysisAI
Out-of-Bounds Read in Autodesk's image handling library crashes Revit and AutoCAD when a user opens a maliciously crafted TIF file during image import. Affected products span Revit 2024, 2026, and 2027 as well as AutoCAD and AutoCAD LT 2027, all below vendor-specified fix versions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to open or import a maliciously crafted TIF image file within an affected Autodesk product version. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.5 (Medium) is consistent with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H: local delivery, no privilege requirement, but mandatory user interaction and impact limited to availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting an architect or engineer at an AEC firm crafts a malicious TIF file and delivers it via email, project collaboration platform, or asset exchange portal. When the victim imports the file into Revit or AutoCAD - a routine operation in design workflows - the image parsing library reads out of bounds, causing the application to crash. … |
| Remediation | Upgrade to the following fixed releases: Revit 2024.3.5 or later, Revit 2026.5.0 or later, Revit 2027.1.0 or later, AutoCAD 2027.1.0 or later, and AutoCAD LT 2027.1.0 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today