EUVD-2026-54295
GHSA-m87c-m8m3-v6f3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious BMP with fake pointers
-
DeliveryDeliver via email or shared project file
-
ExploitVictim opens file in Autodesk product
-
ExecutionBMP parser dereferences untrusted pointer
-
ImpactArbitrary code executes as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Untrusted pointer prevention
|
| Exploitation Conditions | The victim must open a maliciously crafted BMP file using an affected Autodesk product - this is the sole prerequisite per the CVSS UI:R rating. No elevated privileges, authentication, or special software configuration are required (PR:N, AC:L). Exploitation is limited to the process context of the running Autodesk application (S:U), meaning an attacker does not automatically gain kernel-level or cross-process access. The attack is constrained to scenarios where the attacker can deliver a BMP file and social-engineer the victim into opening it; automated or unauthenticated remote exploitation is not possible given the AV:L/UI:R combination. |
| Impact | CVSS 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a credible but access-constrained threat. The local attack vector (AV:L) and required user interaction (UI:R) are meaningful limiters: exploitation requires the victim to open a malicious BMP file in an affected Autodesk application, which is a socially-engineered delivery dependency. AC:L and PR:N indicate no special conditions or credentials are required beyond file delivery. The full CIA triad impact (H/H/H) confirms complete process compromise upon successful exploitation. EPSS data was not provided, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC confirm this is currently an unpublicized vulnerability. Real-world risk is moderate-to-high for organizations in engineering, architecture, and manufacturing sectors where Autodesk software is standard tooling - spear-phishing with crafted BMP attachments is a plausible delivery mechanism in those environments. |
| Exploit ScenarioDerived | An attacker targeting an engineer or architect crafts a malicious BMP file embedding attacker-controlled pointer values in the file header or data section and delivers it via email, shared drive, or a compromised project file repository. When the victim opens the file in an affected Autodesk application, the parser dereferences the untrusted pointer, redirecting execution to attacker-controlled code running with the full privileges of the current user process. No public POC has been identified, but CWE-822 vulnerabilities in image parsers are well-understood and frequently weaponized. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Untrusted pointer dereference in Autodesk products' BMP file parser enables arbitrary code execution in the context of the current process. An attacker who can convince a user to open a specially crafted BMP file gains full code execution capability (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV does not list active exploitation, but the high CVSS score and confirmed RCE impact make patching a clear priority for Autodesk-heavy environments. Vendor advisory ADSK-SA-2026-0012 is the authoritative source.
RemediationAI
Apply the patches detailed in Autodesk security advisory ADSK-SA-2026-0012, available at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012. No exact fix version was specified in the available data, so the advisory should be consulted directly to confirm the minimum patched release for each affected product. As a compensating control while patching, configure email and web gateways to strip or quarantine BMP file attachments, reducing the primary delivery vector. Users should be trained to avoid opening BMP files from untrusted sources. Disabling BMP import functionality within individual Autodesk products, if the product supports that configuration, would eliminate the attack surface entirely but may impact legitimate workflows that rely on BMP input.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-822 (Untrusted Pointer Dereference) occurs when a program reads a pointer-sized value from an attacker-controlled data source - here, the BMP file structure - and uses it directly to dereference memory without validation. BMP is the Windows Device-Independent Bitmap format; its header and data offset fields could contain arbitrary values in a maliciously crafted file. If the Autodesk parser trusts these values as valid memory addresses and dereferences them, an attacker can redirect execution flow to shellcode or ROP gadgets. The CVSS vector (AV:L) confirms this is triggered through local file parsing rather than a network-exposed service. Affected products are identified via Autodesk's security advisory ADSK-SA-2026-0012; exact CPE strings were not enumerated in the available data.
Know when Revit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based local parse trigger (AV:L), no privileges needed (PR:N), user must open file (UI:R), full process compromise with no scope change (S:U, C/I/A:H).
Primary rating from Vendor (autodesk).
CVSS VectorVendor: autodesk
Lifecycle Timeline
2DescriptionCVE.org
A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Executive ViewAI
CVE-2026-7406 affects Autodesk products' BMP file parser, enabling arbitrary code execution when users open malicious files; no public exploit identified at time of analysis, but the confirmed RCE capability poses severe risk to design-intensive organizations. Successful exploitation grants attackers full system access, threatening sensitive intellectual property and project continuity across engineering and creative departments. Organizations using Autodesk tools must treat this as a critical priority given the high CVSS score and absence of available patches.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict or disable BMP file import through Autodesk application settings; deploy network-based file-type filtering and content inspection at email and file-sharing gateways to detect and block malicious BMP files; enforce mandatory user training on social engineering and file-handling hygiene; configure EDR and SIEM tools with behavioral detection for suspicious process execution originating from Autodesk applications; sandbox or network-isolate Autodesk workstations to limit lateral movement if exploitation occurs; develop and maintain an incident response playbook specific to Autodesk compromise scenarios.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. Rate
Use-After-Free in Autodesk Revit's PDF parser allows arbitrary code execution, sensitive data disclosure, or application
Out-of-bounds read in Autodesk Revit's PDF parsing engine exposes users to crashes, sensitive memory disclosure, and arb
Out-of-bounds write in Autodesk Revit's PDF parser allows arbitrary code execution in the context of the current user pr
A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overf
A maliciously crafted DWG file, when parsed through Autodesk Revit, can cause a Stack-Based Buffer Overflow vulnerabilit
A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vuln
A maliciously crafted PDF file, when parsed through Autodesk applications, can force a Memory Corruption vulnerability.
A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vuln
Use-After-Free vulnerability (CWE-416) in Autodesk Revit triggered by maliciously crafted RFA (Revit Family) files that
A maliciously crafted DWG file, when parsed through certain Autodesk applications, can force an Out-of-Bounds Write vuln
CVE-2025-5037 is a memory corruption vulnerability in Autodesk Revit triggered by parsing maliciously crafted RFA, RTE,
Exploit-DB