Autodesk Revit CVE-2026-7405

Exploitation requires the target to open or import a maliciously crafted TIF image file within an affected Autodesk product version. The CVSS vector AV:L/UI:R confirms the attack is local (the file must be accessible on the victim's machine or network share) and requires active user interaction (the user must initiate the image import). No special configuration, enabled feature flag, or elevated privilege is required on the victim's side - the vulnerable code path is exercised during normal image import. Exploitation is limited by the necessity of delivering a crafted file to the target and inducing them to import it; remote unauthenticated network exploitation of a listening service is not possible with this attack vector.

The CVSS 3.1 base score of 5.5 (Medium) is consistent with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H: local delivery, no privilege requirement, but mandatory user interaction and impact limited to availability. EPSS data is not provided, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public exploit has been identified at time of analysis. Real-world risk is moderate for targeted environments: AEC firms and design engineers routinely open externally sourced drawing files and image assets, making social engineering delivery plausible. Automated or internet-scale exploitation is not feasible given the AV:L and UI:R constraints. The 'Information Disclosure' tag in the EUVD record conflicts with the CVSS C:N rating - this discrepancy should be verified with Autodesk advisory ADSK-SA-2026-0012, as OOB reads commonly leak adjacent memory. Overall this is a genuine but targeted-exploitation-only risk, not an internet-facing emergency.

An attacker targeting an architect or engineer at an AEC firm crafts a malicious TIF file and delivers it via email, project collaboration platform, or asset exchange portal. When the victim imports the file into Revit or AutoCAD - a routine operation in design workflows - the image parsing library reads out of bounds, causing the application to crash. Repeated delivery could prevent productive use of the design tool. No public proof-of-concept exploit has been identified at time of analysis.