Autodesk Revit CVE-2026-8325

Exploitation requires that a victim user opens a maliciously crafted PDF file using Autodesk Revit - the vulnerable code path is the application's PDF parser. The CVSS vector confirms AV:L (the attack is local; the file must be parsed on the victim's machine) and UI:R (active user interaction, specifically opening the file, is required). PR:N confirms no elevated privileges are needed to trigger the flaw - any standard Revit user who opens the file is at risk. Limiting factors: the attacker must first deliver the malicious PDF to the victim and socially engineer them into opening it in Revit rather than a standalone PDF viewer; Revit must be installed and the user must choose to open the file through it. There is no indication of a default auto-open or preview behavior that would eliminate the UI:R requirement.

The CVSS 7.8 High score is driven by full C/I/A impact, which is consistent with an RCE-class memory corruption flaw. However, the attack vector (AV:L) and required user interaction (UI:R) substantially reduce the population of reachable targets compared to a network-based flaw - an attacker cannot exploit this without first delivering a malicious PDF and convincing a victim to open it in Revit specifically. No EPSS score was provided in the input data; given no KEV listing and no public POC, real-world exploitation probability at time of analysis is likely modest. The practical threat model is targeted spear-phishing of AEC sector professionals - a realistic but operationally constrained scenario. There is no conflict between the CVSS vector and the description; both consistently indicate local file-open as the trigger. The absence of a specific affected version range in the provided data is a notable gap - defenders cannot confirm patch applicability without consulting the vendor advisory directly.

An attacker crafts a malicious PDF that triggers the out-of-bounds write in Revit's parser, then delivers it to a target architect or engineer via spear-phishing email or a compromised file-sharing platform commonly used in AEC project collaboration. When the victim opens the file in Autodesk Revit, the memory corruption is triggered, potentially yielding code execution under the victim's user account. No public POC exists at time of analysis, so successful exploitation currently requires bespoke exploit development against the parser primitive.