Autodesk Fusion EUVD-2026-111137

Exploitation requires local access and active user interaction: the victim must load or execute attacker-supplied content (a script/add-in or project) inside Autodesk Fusion that invokes the TextCommands.LoadDll API command referencing an attacker-controlled DLL path. There is no network vector and no privilege escalation step - code runs at the privilege level of the current Fusion process. Limiting factors per the CVSS vector are the local attack vector (AV:L) and the mandatory user interaction (UI:R), meaning an attacker cannot trigger this remotely or silently; it depends on convincing a user to open or run malicious content. Affected builds are Fusion 2705.1.30 through below 2706.1.14; updating to 2706.1.14 or later is the vendor-provided fix.

This is a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a locally-triggered, user-interaction-dependent code execution flaw - not a remotely-reachable server bug. The TextCommands.LoadDll command exposed by the Fusion API (CWE-749, Exposed Dangerous Function) lets a crafted dynamic library be loaded from an arbitrary path and run in the context of the Fusion process. No EPSS score was supplied, the vulnerability is NOT in CISA KEV, and no POC or exploit reference is present, so the real-world signals point to no confirmed or widespread exploitation. The vuln.today decision label is 'this_week', consistent with a patched, high-severity local-execution issue that warrants prompt but not drop-everything remediation. The main gating factor against mass exploitation is UI:R: the victim must be induced to load/run attacker-supplied content inside Fusion, which makes this a social-engineering / malicious-file-delivery problem rather than a wormable network threat. No conflicting signals were found in the supplied data; the vector and description agree that access is local and interaction is required.

An attacker distributes a malicious Fusion script or project (e.g. via a shared add-in, tutorial file, or downloaded design) that invokes the TextCommands.LoadDll API command pointing to an attacker-controlled DLL. When the victim opens or runs it in Fusion, the crafted library is loaded from the arbitrary path and executes arbitrary code with the privileges of the Fusion process. No public exploit code or POC reference was supplied in the input.