What is the CVSS score of EUVD-2026-54295?

EUVD-2026-54295 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Autodesk Products are affected by EUVD-2026-54295?

CVE-2026-7406 affects Autodesk products' BMP file parser, enabling arbitrary code execution when users open malicious files; no public exploit identified at time of analysis, but the confirmed RCE…. A patch is available.

How to fix or mitigate EUVD-2026-54295?

Within 24 hours, inventory all Autodesk product versions in production through license management systems, alert users to cease opening BMP files from external or untrusted sources, and disable BMP file format support in Autodesk application settings where functionality allows. Within 7 days, implement file-type filtering at email gateways and endpoint controls to block incoming BMP files, configure EDR and SIEM platforms to monitor Autodesk processes for abnormal execution patterns, and conduct targeted security awareness training on file-based social engineering risks. Within 30 days, establish recurring contact with Autodesk to track patch timelines and obtain version guidance, evaluate contingency options including temporary migration to alternative design platforms if patch schedules become unacceptable, and formally document all compensating controls in your risk register.

Autodesk Products EUVD-2026-54295

| CVE-2026-7406 HIGH

Untrusted Pointer Dereference (CWE-822)

2026-08-06 psirt@autodesk.com

GHSA-m87c-m8m3-v6f3

RCE

7.8

CVSS 3.1 · Vendor: autodesk

Severity by source

Vendor (autodesk) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-based local parse trigger (AV:L), no privileges needed (PR:N), user must open file (UI:R), full process compromise with no scope change (S:U, C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (autodesk).

CVSS VectorVendor: autodesk

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 06, 2026 - 23:03 EUVD

Analysis Generated

Aug 06, 2026 - 22:38 vuln.today

CVE Published

Aug 06, 2026 - 22:18 nvd

HIGH 7.8

DescriptionCVE.org

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

AnalysisAI

Untrusted pointer dereference in Autodesk products' BMP file parser enables arbitrary code execution in the context of the current process. An attacker who can convince a user to open a specially crafted BMP file gains full code execution capability (C:H/I:H/A:H). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious BMP with fake pointers

Delivery

Deliver via email or shared project file

Exploit

Victim opens file in Autodesk product

Execution

BMP parser dereferences untrusted pointer

Impact

Arbitrary code executes as current user

Access

Craft malicious BMP with fake pointers

Delivery

Deliver via email or shared project file

Exploit

Victim opens file in Autodesk product

Execution

BMP parser dereferences untrusted pointer

Impact

Arbitrary code executes as current user

Vulnerability AssessmentAI

Exploitation	The victim must open a maliciously crafted BMP file using an affected Autodesk product - this is the sole prerequisite per the CVSS UI:R rating. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a credible but access-constrained threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker targeting an engineer or architect crafts a malicious BMP file embedding attacker-controlled pointer values in the file header or data section and delivers it via email, shared drive, or a compromised project file repository. When the victim opens the file in an affected Autodesk application, the parser dereferences the untrusted pointer, redirecting execution to attacker-controlled code running with the full privileges of the current user process. …
Remediation	Apply the patches detailed in Autodesk security advisory ADSK-SA-2026-0012, available at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0012. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Autodesk product versions in production through license management systems, alert users to cease opening BMP files from external or untrusted sources, and disable BMP file format support in Autodesk application settings where functionality allows. …

Threat intelligence, references, and detailed analysis are available after sign-in.