Autodesk AutoCAD EUVD-2026-50375

Exploitation requires that a victim user actively open a maliciously crafted DWG or DXF file within AutoCAD, AutoCAD LT, or DWG TrueView (UI:R per CVSS). The attack vector is local (AV:L), meaning the crafted file must be present on the target system or opened directly from an accessible path - network delivery alone (e.g., via email or download) is insufficient without the user's file-open action. No elevated privileges are required on the system (PR:N); any standard user account running one of the affected applications is sufficient. Exploitation is limited by the requirement for user interaction and is not exploitable against default configurations without a social engineering or file-delivery component. There is no known network-exposed parsing pathway that would allow remote triggering without user action.

The NVD-assigned CVSS 3.1 score of 5.5 (Medium) reflects a local attack vector (AV:L) with user interaction required (UI:R), correctly scoping the threat to file-open scenarios rather than network-reachable services. The primary impact is availability (A:H - crash), but the vulnerability description explicitly references potential sensitive information disclosure, which conflicts with the provided C:N metric; defenders should treat memory disclosure as a plausible secondary impact not fully captured by the official score. No EPSS data was supplied, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The lack of a POC and the UI:R gating factor meaningfully constrain the exploitability window to targeted spear-phishing or malicious file-share attacks rather than automated mass exploitation. Overall, this is a genuine but moderate-priority issue - elevated for organizations in AEC (architecture, engineering, construction) sectors where DWG/DXF file exchange with untrusted parties is routine.

An attacker crafts a malformed DWG or DXF file containing out-of-bounds-triggering geometry or header data and delivers it to a target engineer via email, file-sharing platform, or a compromised project collaboration portal. When the victim opens the file in AutoCAD, AutoCAD LT, or DWG TrueView, the parser accesses memory outside its allocated buffer, causing the application to crash - potentially also leaking process memory contents. No public proof-of-concept code has been identified, but the file-format nature of the bug makes crafting a trigger relatively accessible to motivated threat actors.